ctf-malware

name	ctf-malware
description	Malware & network analysis: obfuscated JS/PowerShell/VBA, PE/.NET analysis, PyInstaller/PyArmor, custom C2 protocols (RC4, AES, DNS), YARA rules, shellcode, memory-forensics IOCs, anti-sandbox/anti-VM bypass.

CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Additional Resources

• scripts-and-obfuscation.md - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection)
• c2-and-protocols.md - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
• pe-and-dotnet.md - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor

---

Pattern Recognition Index

Dispatch on byte/file signals, never the sample's reputation.

Signal	Technique → file
File starts with PK + contains package.json + .vsix extension	VSCode extension activation-event exfil → scripts-and-obfuscation.md
High-entropy extension.js/index.js > 50 KB with child_process	JS obfuscator.io / JSFuck deobfuscation → scripts-and-obfuscation.md
PowerShell -enc <b64> or IEX in parent process logs	PS script decode + reflection assembly → scripts-and-obfuscation.md
PCAP with custom TCP port, payload bytes distributed uniformly	Custom crypto / RC4 / AES session key recovery → c2-and-protocols.md
PCAP with DNS TXT records carrying base32/64 blobs	DNS-based C2 exfil → c2-and-protocols.md
PCAP where specific User-Agent receives non-default responses	UA-gated C2 path-hex-XOR → (see ctf-forensics/network-advanced.md)
PE32/PE64 with .text sections having packer signatures (UPX, VMProtect, Themida)	Unpacking + dump-after-decrypt → pe-and-dotnet.md
.NET assembly with obfuscated strings + reflection calls	dnSpy + de4dot + string decryption → pe-and-dotnet.md
PyInstaller binary (MEIPASS, _MEIxxxx strings)	pyinstxtractor + pycdc → pe-and-dotnet.md
Process-injection IoCs in memory dump (RWX allocations, NtUnmapViewOfSection)	Volatility malfind + process hollowing detection → scripts-and-obfuscation.md
Anti-VM checks (cpuid hypervisor bit, RDTSC timing, specific drivers)	VM-detection bypass in analysis sandbox → scripts-and-obfuscation.md
WebSocket frame with visible RC4 key-setup or KSA signatures	RC4 WebSocket reversing → c2-and-protocols.md

Recognize the artefact or protocol pattern. The sample's name is not a signal.

---

---

For inline snippets and quick-reference tables, see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first.