malware-analysis
Installation
SKILL.md
What this skill does
Runs a five-phase malware analysis pipeline on a suspicious file: triage (file type, hashes, VirusTotal lookup, YARA), static analysis (PE/ELF headers, imports, strings, packer detection), dynamic analysis (sandbox detonation, process/network/filesystem monitoring), code analysis (disassembly, decompilation, algorithm/C2 identification), and classification (malware family, MITRE ATT&CK TTP mapping). Produces a structured report with IOCs, detection rules, and remediation guidance.
When to use
- Analyzing a suspicious binary, script, or document during incident response
- Performing malware reverse engineering for threat intelligence
- Producing YARA/Sigma/Snort detection rules from a malware sample
- Mapping an unknown sample to a known malware family or APT toolset