malware-analysis

Malware Analysis

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-reverse.md — confirm that this skill's operations are authorized routine operations
2. NOW: Confirm whether the current task falls within this skill's scope
3. NEXT: Read ../tool-index.md to verify tool availability and actual paths
4. NEXT: When a tool is missing, invoke bootstrap; do not guess paths
5. ACT: Enter the first step of the workflow and execute; do not stall in the confirmation state

YARA / Sigma / sandbox / IOC extraction / anti-anti-analysis Static + dynamic + behavioral, three in one

Applicable Scenarios

• Malware sample analysis (PE/ELF/Mach-O/APK/scripts)
• YARA rule authoring and validation
• Sigma behavioral detection rule generation
• Sandbox automation orchestration
• IOC extraction and threat intelligence
• Anti-analysis technique detection and bypass

Six-Phase Analysis Process

Phase 1: Initial Triage

# Quick static checks
file sample.exe                      # File type
strings sample.exe | grep -i "http\|cmd\|powershell\|base64"  # Quick IOCs
rabin2 -zz sample.exe                # String extraction + cross-references
floss sample.exe                     # Deobfuscated string extraction (FireEye)

# PE header analysis
pecheck sample.exe                   # PE structure validation
pescan sample.exe                    # Anomaly detection (section table, entry point)
diec sample.exe                      # Detect It Easy (packer/compiler identification)

# Hash lookup
sha256sum sample.exe
# → VirusTotal / MalwareBazaar / Triage lookup

Phase 2: Static Analysis

Disassembly/decompilation:
□ IDA Pro / Ghidra: in-depth decompilation
□ radare2: fast CLI analysis
□ x64dbg: Windows GUI debugger

Key analysis areas:
□ Entry Point → initialization logic
□ Import table → API purpose inference (CreateRemoteThread=injection, CryptEncrypt=ransomware)
□ Resource section → embedded Payload (.rsrc section)
□ String table → URL/C2/file paths/Base64 blobs
□ TLS callbacks → execute before the debugger starts