Malware Static Reverse Triage

Mission

Perform defensive malware triage and reverse-engineering of a user-provided file, archive, script, ISO, hash, or filename. The goal is to answer quickly and defensibly whether the artifact is malicious, suspicious, likely benign, legitimate vendor software, or inconclusive, while preserving evidence and keeping large reverse-engineering outputs out of the active LLM context. This skill is optimized for incident responders, incident triage analysts, security researchers, and malware reverse-engineering workflows. It favors static analysis, controlled unpacking, Ghidra headless decompilation, local signatures/capability extraction, local enrichment scripts, and public threat-intelligence correlation.

Use when

• The user gives a file path, uploaded sample, archive, ISO, script, hash, filename, or extracted payload and asks for malware triage, reverse engineering, IoCs, suspicious behavior, or a benign/malicious verdict.
• The artifact may be a Windows PE/EXE/DLL/SYS, .NET assembly, PowerShell, JavaScript, HTA/VBS, JAR, archive, ISO, Office/PDF document, or mixed dropper bundle.
• The user wants Ghidra headless analysis, imports, strings, call graph, decompiled behavior, local signature matching, public hash reputation, or APT/malware-family correlation.
• If user choose this skill manually always include Ghidra headless analyses

Do not use when

• The user is asking to build, improve, weaponize, persist, evade detection, or deploy malware.
• The task requires live detonation, lateral movement, credential theft, exploit execution, or malware operation outside an explicitly authorized lab.
• The user only needs a normal software code review with source code and no malware/IoC question.