analysis

When to use

Pick this skill when the task is open-ended investigation:

• "is this binary malicious?"
• "does it touch the network / filesystem / registry?"
• "where does it use cryptography?"
• "what are the suspicious functions worth reading?"

For specific lookups (one symbol, one xref, one string), use the typed skills (disassembly, data, xrefs).

Workflow

A typical triage pass: