메뉴
Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.
Execute and monitor malware in controlled sandbox environments. Use when you need to observe runtime behavior, capture network traffic, monitor process activity, analyze file/registry changes, or understand actual malware functionality beyond static analysis. Guides safe execution with Procmon, Wireshark, Process Hacker (now System Informer), Sysmon, and automated sandboxes.
Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.
Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell scripts, JavaScript, archives, HTA files, disk images (ISO/IMG/VHD/VHDX), and Linux ELF binaries. Use when you encounter documents, scripts, disk images, or non-Windows executables that require format-specific analysis tools and techniques.
| name | malware-triage |
| description | Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps. |
Systematic workflow for rapid malware assessment, classification, and prioritization for professional malware analysis and enterprise security operations.
Use this skill when the user needs to:
Triage is the critical first phase of malware analysis that:
Goal: Make informed decisions about analysis approach within 5-30 minutes per sample.
Calculate Hashes:
python scripts/hash_calculator.py sample.exe
Document:
Check Online Reputation:
Record:
For PE Files:
Check packing/obfuscation
Examine PE structure
Review import table
references/indicators.md for suspicious APIsExtract strings
For Scripts (PowerShell, VBS, JavaScript):
For Office Documents:
When a sample is packed or protected, static analysis yields limited results. Identify and document packing before proceeding.
Identify Packing:
LoadLibrary / GetProcAddress / VirtualAlloc / VirtualProtect (runtime loading pattern)UPX0, UPX1, UPX2 (UPX); .themida, .winlicence (Themida/WinLicense); .vmp0, .vmp1 (VMProtect); .aspack (ASPack); .MPRESS1, .MPRESS2 (MPRESS).text, .data, .rsrc), or unusually small code sectionCommon Packers and Indicators:
| Packer | Key Indicators | Reversible? |
|---|---|---|
| UPX | UPX0/UPX1 sections, high entropy, UPX! magic in overlay | Yes — upx -d sample.exe |
| Themida / WinLicense | .themida section, virtualized code, anti-debug tricks, large protected section | No — dynamic analysis required |
| VMProtect | .vmp0/.vmp1 sections, custom VM bytecode, heavy anti-tamper | No — dynamic analysis required |
| ASPack | .aspack section, low import count, aSPack string in binary | Partially — tools available |
| MPRESS | .MPRESS1/.MPRESS2 sections, LZMA compression | Partially — tools available |
| Enigma Protector | .enigma1/.enigma2 sections, license-check stubs | No — dynamic analysis required |
| Custom packer | Unknown section names, high entropy, minimal imports, no recognizable signature | No — dynamic analysis required |
What to Do When Packing is Detected:
upx -d packed_sample.exe -o unpacked_sample.exe
# Verify unpacking succeeded
python scripts/hash_calculator.py unpacked_sample.exe
Tools for Packer Detection:
Triage Report Updates for Packed Samples:
Packed: Yes - [Packer name or "Unknown packer"] in the File Information sectionDetermine Malware Type:
Consult references/indicators.md for patterns.
Common types:
Assess Threat Level:
Evaluate Sophistication:
Based on static indicators, predict:
Process Activity:
File System:
Registry:
Network:
Persistence:
Determine Priority:
Immediate (analyze now):
Standard (normal queue):
Low (defer if needed):
Analysis Decision:
Proceed with full analysis if:
Quick report if:
Use this format to document findings:
## Malware Triage Report
**Sample:** [filename]
**Date:** [date]
**Analyst:** [name]
### File Information
- **MD5:** [hash]
- **SHA1:** [hash]
- **SHA256:** [hash]
- **Size:** [bytes]
- **Type:** [PE32/PE64/Script/etc]
- **Packed:** [Yes/No - Packer name]
### Online Reputation
- **VirusTotal:** [XX/YY detections - Link]
- **Known Family:** [Family name or Unknown]
- **First Seen:** [Date or Unknown]
### Static Indicators
**PE Analysis:**
- Compilation Date: [date]
- Digital Signature: [Valid/Invalid/None]
- Sections: [names and entropy]
- Entry Point: [location]
**Suspicious Imports:**
- [DLL]: [Function, Function, ...]
- [Key: Process injection, Network, Anti-analysis]
**Notable Strings:**
- URLs: [list]
- IPs: [list]
- Paths: [list]
- Registry: [list]
- Mutex: [name if found]
### Classification
**Type:** [Trojan/Ransomware/Infostealer/etc]
**Threat Level:** [Critical/High/Medium/Low]
**Sophistication:** [Simple/Moderate/Advanced/APT]
**Primary Capabilities:**
- [Capability 1]
- [Capability 2]
- [Capability 3]
### Predicted Behaviors
**Process Activity:**
- [Expected behavior]
**File System:**
- [Expected modifications]
**Registry:**
- [Expected changes]
**Network:**
- [Expected communication]
**Persistence:**
- [Expected mechanism]
### Initial IOCs
**File Indicators:**
- Hashes listed above
- [Additional file indicators]
**Network Indicators:**
- [IPs from strings]
- [Domains from strings]
**Host Indicators:**
- [Registry keys]
- [File paths]
- [Mutex names]
### Recommendation
**Priority:** [Immediate/Standard/Low]
**Next Steps:**
1. [Action 1 - e.g., Proceed with full dynamic analysis]
2. [Action 2 - e.g., Create YARA rule]
3. [Action 3 - e.g., Search network for IOCs]
**Analysis Approach:**
[Full analysis / Behavioral confirmation / Quick signature creation]
**Estimated Time:** [time estimate for full analysis]
When analyzing multiple samples, efficient triage is critical:
Quick Triage (5 min/sample):
Standard Triage (15 min/sample):
Comprehensive Triage (30 min/sample):
Strategy:
See references/indicators.md for comprehensive lists of:
See references/triage_checklist.md for:
# Run from the malware-triage/ directory:
python scripts/hash_calculator.py <sample_path>
# Or from the repo root:
python malware-triage/scripts/hash_calculator.py <sample_path>
Quickly calculates all three hashes (MD5, SHA1, SHA256) for documentation.
Static Analysis:
Online Services:
Triage findings guide the full analysis:
Use predictions to:
Triage report becomes:
Before concluding triage:
User request: "I have a suspicious .exe file, help me triage it"
Workflow: