practical-malware-analysis

name	practical-malware-analysis
description	Defensive malware analysis and reverse-engineering workflow. Use for authorized lab analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, IDA/Ghidra/debugger reasoning, anti-analysis handling, unpacking, host/network signature creation, and concise malware reports.

Practical Malware Analysis

Use this skill only for defensive, educational, forensic, incident-response, or lab work on samples the user is authorized to analyze. Keep malware contained. Do not help deploy malware, establish persistence on third-party systems, steal credentials, evade detection for operational abuse, or provide working offensive payloads. Prefer analysis, containment, detection, and reporting.

Quick Workflow

1. Confirm authorization, sample source, goal, allowed tools, network policy, and whether execution is permitted.
2. Use an isolated VM snapshot, no sensitive host data, host-only or simulated networking by default, and synthetic credentials/files.
3. Hash the file and preserve the original evidence read-only.
4. Perform static triage: file type, PE headers, sections, imports, exports, resources, strings, entropy, compiler/packer hints, and reputation if allowed.
5. Decide whether the sample is packed or obfuscated. If yes, load references/anti-analysis-and-unpacking.md.
6. If execution is authorized, monitor process, file, registry, service, mutex, network, and child-process activity under a snapshot.
7. Use disassembly/decompilation to identify entry points, API arguments, cross-references, strings, config decoding, persistence, networking, injection, and privilege behavior.
8. Use debugging for runtime strings/configuration, dynamic API resolution, anti-analysis branches, unpacking stubs, and decoded buffers.
9. Extract host and network indicators, then write detection logic and a concise report.

Load References As Needed

• references/analysis-methodology.md: chapter map, evidence handling, static/dynamic triage, advanced analysis, and report templates.
• references/windows-reversing.md: x86, PE, IDA/Ghidra workflows, Windows APIs, registry, services, DLLs, networking, shellcode, C++, and x64.
• references/anti-analysis-and-unpacking.md: anti-disassembly, anti-debugging, anti-VM, packers, safe unpacking, and encoded data handling.
• references/behavior-and-detection.md: malware capability taxonomy, host/network IOCs, YARA guidance, network signatures, and detection checklist.

Analysis Rules

• Separate observed facts from inferred intent.
• Work broad to narrow; do not spend the whole analysis proving every instruction.
• Pivot among strings, imports, PE structure, debugger, disassembler, packet capture, registry/file monitors, memory dumps, and sandbox traces.
• Test one hypothesis at a time and preserve notes: timestamp, tool, sample hash, environment, observation, and confidence.
• Avoid live C2 contact by default. Prefer service simulation, local listeners, packet capture, and controlled replay.
• Never submit sensitive or targeted samples to public sandboxes without permission.

Default Outputs

For triage: sample identity, environment, static observations, dynamic observations if allowed, likely capabilities, IOCs, next reverse-engineering steps, and containment/detection suggestions.

For a full report: executive summary, metadata, environment, behavior summary, persistence/privilege/evasion/network/payload findings, IOCs, detection logic, remediation, confidence, and unresolved questions.