| name | malware-analysis |
| description | Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system. |
| license | MIT |
| compatibility | Requires filesystem-based agent with bash, Python 3, YARA, and analysis tools (pefile, oletools, Cuckoo/CAPE). |
| allowed-tools | Bash Read Write Edit Glob Grep WebSearch |
| metadata | {"user-invocable":"true","argument-hint":"<sample-path>"} |
Malware Analysis
Document Map
| Task | Document |
|---|
| PE structure, YARA rules, shellcode disassembly, script deobfuscation | Static Triaging |
| Sandbox setup, strace/ltrace, process injection detection, sandbox evasion | Dynamic Sandboxing |
| PE analysis, .NET decompilation, malware config extraction, packer identification | PE / .NET Analysis |
| Beacon detection, DGA identification, Cobalt Strike decoding, protocol analysis | C2 Protocols |
Static Triage
file sample
strings sample | grep -iE '(http|https|\.exe|cmd|powershell|key|config|password)'
xxd sample | head -20
md5sum sample && sha256sum sample
YARA Quick Scan
rule Suspicious_Indicators {
strings:
$p1 = "cmd.exe" nocase
$p2 = "powershell -enc" nocase
$p3 = "CreateRemoteThread" nocase
$p4 = "VirtualAllocEx" nocase
$mz = {4D 5A}
condition:
$mz and 2 of ($p*)
}
PE Analysis
import pefile
pe = pefile.PE("sample.exe")
print(f"Sections: {len(pe.sections)}")
for s in pe.sections:
print(f" {s.Name.decode().strip(chr(0))}: raw={s.SizeOfRawData} virt={s.Misc_VirtualSize} entropy={s.get_entropy():.2f}")
print(f"Imports: {[d.dll.decode() for d in pe.DIRECTORY_ENTRY_IMPORT]}")
print(f"Entry: 0x{pe.OPTIONAL_HEADER.AddressOfEntryPoint:x}")
