malware-analysis

name	malware-analysis
description	Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system.
license	MIT
compatibility	Requires filesystem-based agent with bash, Python 3, YARA, and analysis tools (pefile, oletools, Cuckoo/CAPE).
allowed-tools	Bash Read Write Edit Glob Grep WebSearch
metadata	{"user-invocable":"true","argument-hint":"<sample-path>"}

Malware Analysis

Document Map

Task	Document
PE structure, YARA rules, shellcode disassembly, script deobfuscation	Static Triaging
Sandbox setup, strace/ltrace, process injection detection, sandbox evasion	Dynamic Sandboxing
PE analysis, .NET decompilation, malware config extraction, packer identification	PE / .NET Analysis
Beacon detection, DGA identification, Cobalt Strike decoding, protocol analysis	C2 Protocols

Static Triage

file sample
strings sample | grep -iE '(http|https|\.exe|cmd|powershell|key|config|password)'
xxd sample | head -20
md5sum sample && sha256sum sample

YARA Quick Scan

rule Suspicious_Indicators {
    strings:
        $p1 = "cmd.exe" nocase
        $p2 = "powershell -enc" nocase
        $p3 = "CreateRemoteThread" nocase
        $p4 = "VirtualAllocEx" nocase
        $mz = {4D 5A}
    condition:
        $mz and 2 of ($p*)
}

PE Analysis

import pefile
pe = pefile.PE("sample.exe")
print(f"Sections: {len(pe.sections)}")
for s in pe.sections:
    print(f"  {s.Name.decode().strip(chr(0))}: raw={s.SizeOfRawData} virt={s.Misc_VirtualSize} entropy={s.get_entropy():.2f}")
print(f"Imports: {[d.dll.decode() for d in pe.DIRECTORY_ENTRY_IMPORT]}")
print(f"Entry: 0x{pe.OPTIONAL_HEADER.AddressOfEntryPoint:x}")