malware-analysis

name	malware-analysis
description	Use when characterising a malware sample, the user asks "what does this binary do?" / "analyse this hash deeply", or `/hash-investigation` flags a novel sample warranting deeper review. Static + dynamic methodology, behavioural indicators, sandbox interpretation.
user-invocable	true
metadata	{"version":"1.1.0"}

Malware Analysis Guide

This skill provides analytical guidance for understanding malware samples. It does NOT execute malware — it tells you what to look for in analysis reports, sandbox results, and VirusTotal data.

Static Analysis

PE Header Analysis

• Compilation timestamp: When was it compiled? Anomalous dates suggest timestomping.
• Sections: Unusual section names (not .text/.data/.rss/.reloc) suggest packing or custom builders.
• Entropy: High entropy (>7.0) in sections suggests encryption or compression (packed).
• Imports: Key suspicious imports indicate behavior:

Import	Indicates
VirtualAlloc, VirtualProtect	Memory manipulation (injection, unpacking)
CreateRemoteThread, WriteProcessMemory	Process injection (T1055)
RegSetValueEx, RegCreateKeyEx	Registry persistence (T1547)
InternetOpenUrl, HttpSendRequest	Network communication (T1071)
CryptEncrypt, CryptDecrypt	Encryption (ransomware or C2 encryption)
CreateService, StartService	Service persistence (T1543)
AdjustTokenPrivileges	Privilege escalation (T1134)
IsDebuggerPresent, CheckRemoteDebuggerPresent	Anti-analysis (T1622)

String Analysis

Look for:

• URLs, IP addresses, domain names (C2 infrastructure)
• File paths (drop locations, persistence targets)
• Registry keys (persistence mechanisms)
• User-Agent strings (C2 communication patterns)
• Encryption keys or encoded data
• Error messages or debug strings (developer artifacts)
• Mutex names (used to prevent multiple instances)

Packer Identification

Common packers: UPX, Themida, VMProtect, ASPack, MPRESS. Packed samples need unpacking before full static analysis. High entropy + few meaningful strings = likely packed.

Dynamic Analysis (Sandbox Interpretation)

Process Behavior

• Child processes spawned (especially cmd.exe, powershell.exe, wscript.exe)
• Process injection into legitimate processes (svchost, explorer, lsass)
• Privilege escalation attempts
• Anti-analysis checks (VM detection, sandbox detection, timing checks)

File System Activity

• Files dropped (where? what type?)
• Files modified (host files, configuration files)
• Files deleted (covering tracks, removing competitors)

Registry Activity

• Run/RunOnce keys (persistence)
• Service creation (persistence)
• Firewall rule modification (defense evasion)
• Security tool disabling

Network Activity

• DNS queries (C2 domains, DGA-generated domains)
• HTTP/HTTPS connections (C2 communication, data exfiltration)
• Raw TCP/UDP connections (custom protocol C2)
• Certificate information (self-signed = suspicious)

Analysis Output Template

## Malware Analysis: [Sample Name/Hash]

### Sample Information
- SHA-256: [hash]
- File type: [PE/ELF/document/script]
- File size: [bytes]
- First seen: [date]
- Detection ratio: [X/Y from VT]
- Family: [if identified]

### Static Analysis Findings
- Compilation: [timestamp, language, compiler]
- Packing: [packer identified or unpacked]
- Key imports: [suspicious APIs]
- Notable strings: [C2, paths, keys, mutexes]

### Dynamic Behavior
- Execution chain: [parent → child processes]
- Persistence: [mechanism and location]
- C2 communication: [protocol, destination, pattern]
- Data collection: [what data is targeted]
- Defense evasion: [anti-analysis, obfuscation]

### MITRE ATT&CK Mapping
| Tactic | Technique | Observed Behavior |
|--------|-----------|-------------------|

### IOCs Extracted
| Type | Value | Context |
|------|-------|---------|

### Assessment
[What is this malware? What does it do? Who might use it? Confidence level.]

Tooling for the sections above

When the sample is available in ReversingLabs Spectra Analyze (A1000), /lookup-reversinglabs report <hash> --detailed is the single richest source for almost everything on this page — it returns vendor-authoritative classification, TitaniumCore static analysis (headers, imports, strings, packer detection), attack (auto-mapped MITRE ATT&CK tactics + techniques from observed behaviour), rl_cloud_sandbox (dynamic analysis output), and networkthreatintelligence (C2 indicators extracted from the sample). Use it to pre-fill the MITRE ATT&CK Mapping and IOCs Extracted tables in the output template before doing your own analysis. Pivot to siblings in the same family with /lookup-reversinglabs search 'threatname:<family> classification:malicious', and to parent/child relationships with containers / extracted.

Related skills

• Sample triage before deep analysis — /hash-investigation for VT detection ratio, family attribution, behaviour tags, and pre-existing community context. If detection is high and family is known, the lookup may be sufficient.
• Vendor-authoritative analysis — /lookup-reversinglabs report <hash> --detailed for classification, MITRE ATT&CK mapping, sandbox, and network indicators in a single call. Run this whenever RL credentials are configured — it shortcuts most of the manual static + dynamic interpretation below.
• C2 and infrastructure extraction — /lookup-virustotal file <hash> --relationships contacted_ips,contacted_domains,contacted_urls,communicating_files,dropped_files,parent_files (VT) and /lookup-reversinglabs report <hash> --fields networkthreatintelligence (RL); pivot each via /indicator-pivoting
• Vendor actor attribution — /lookup-crowdstrike indicator <hash> for the threat actors and malware family CrowdStrike Falcon Intel links to the sample, plus report references; then /lookup-crowdstrike ttps <actor> to pull that actor's ATT&CK technique set into the MITRE ATT&CK Mapping table. Run whenever CrowdStrike credentials are configured.
• Community attribution — /lookup-otx file <hash> for pulses and YARA matches
• Internal correlation — /lookup-misp search-attributes --value <hash> and/or /lookup-opencti lookup <hash> to surface prior catalogued intel; if the analysis produces new indicators worth keeping, /lookup-misp add-attribute / create-event and/or /lookup-opencti create-indicator
• Ransomware-family lineage — /lookup-ransomwarelive yara <group> and iocs <group> provide a curated reference set if VT family classification points to a known group
• Detection authoring — /yara-writing for family/sample rules; /sigma-writing for behavioural detection
• Apply rigor — /score-source, /apply-tlp, /confidence-language