malware-triage

Name: malware-triage
Author: gl0bal01

43stars3forks

How to install malware-triage?

gl0bal01/malware-analysis-claude-skills/malware-triage

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-triage

Installs into the current project.

Summary

Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.

Files · 1

View on GitHub

SKILL.md

1	# Malware Triage
2
3	Systematic workflow for rapid malware assessment, classification, and prioritization for professional malware analysis and enterprise security operations.
4
5	## When to Use This Skill
6
7	Use this skill when the user needs to:
8	- Perform initial assessment of malware samples
9	- Quickly classify and prioritize samples
10	- Identify key indicators without deep analysis
11	- Decide whether to proceed with full analysis
12	- Triage multiple samples efficiently
13	- Create initial findings summary
14	- Predict malware behaviors before dynamic analysis
15
16	## Overview
17
18	Triage is the critical first phase of malware analysis that:
19	1. Quickly identifies key characteristics
20	2. Classifies malware type and threat level
21	3. Determines analysis priority
22	4. Predicts behaviors to guide deeper analysis
23	5. Extracts immediate IOCs
24
25	Goal: Make informed decisions about analysis approach within 5-30 minutes per sample.
26
27	## Triage Workflow
28
29	### Phase 1: Basic Information Gathering (5 minutes)
30
31	Calculate Hashes:
32	```bash
33	python scripts/hash_calculator.py sample.exe
34	```
35
36	Document:
37	- MD5, SHA1, SHA256
38	- Original filename
39	- File size
40	- File type (PE32/PE64/Script/Document)
41
42	Check Online Reputation:
43	- VirusTotal (virustotal.com)
44	- MalwareBazaar (bazaar.abuse.ch)
45	- Hybrid Analysis
46	- Any.Run
47
48	Record:
49	- Detection rate
50	- Known family name (if identified)
51	- Previous submission dates
52	- Community comments
53
54	### Phase 2: Quick Static Analysis (10 minutes)
55
56	For PE Files:
57	1. Check packing/obfuscation
58	- Use Detect It Easy (DIE) or PEiD
59	- Check entropy (>7.0 = likely packed)
60	- Document packer name if identified
61
62	2. Examine PE structure
63	- Compilation timestamp
64	- Section names and characteristics
65	- Digital signature status
66	- Entry point location
67	- Overlay data presence
68
69	3. Review import table
70	- See `references/indicators.md` for suspicious APIs
71	- Note process injection functions
72	- Note network functions
73	- Note anti-analysis functions
74
75	4. Extract strings
76	- URLs and IP addresses
77	- File paths
78	- Registry keys
79	- Mutex names
80	- Error messages
81	- Email addresses
82
83	For Scripts (PowerShell, VBS, JavaScript):
84	1. Check obfuscation level
85	2. Look for Base64/hex encoding
86	3. Identify download/execute patterns
87	4. Extract URLs and IPs
88	5. Check for embedded payloads
89
90	For Office Documents:
91	1. Check for macros
92	2. Examine OLE streams
93	3. Look for external references
94	4. Check metadata
95	5. Identify exploit indicators
96
97	### Packed Sample Handling
98
99	When a sample is packed or protected, static analysis yields limited results. Identify and document packing before proceeding.
100
101	Identify Packing:
102	- Entropy analysis — Overall entropy >7.0 or individual sections with entropy >6.8 strongly indicate packing or encryption
103	- Import table — Very few imports, or imports limited to `LoadLibrary` / `GetProcAddress` / `VirtualAlloc` / `VirtualProtect` (runtime loading pattern)
104	- Section names — Known packer section names: `UPX0`, `UPX1`, `UPX2` (UPX); `.themida`, `.winlicence` (Themida/WinLicense); `.vmp0`, `.vmp1` (VMProtect); `.aspack` (ASPack); `.MPRESS1`, `.MPRESS2` (MPRESS)
105	- Section characteristics — Executable sections with no readable strings, or a single large section combining code and data
106	- PE anomalies — Entry point outside the first section, missing standard sections (`.text`, `.data`, `.rsrc`), or unusually small code section
107
108	Common Packers and Indicators:
109
110	\| Packer \| Key Indicators \| Reversible? \|
111	\|--------\|----------------\|-------------\|
112	\| UPX \| `UPX0`/`UPX1` sections, high entropy, `UPX!` magic in overlay \| Yes — `upx -d sample.exe` \|
113	\| Themida / WinLicense \| `.themida` section, virtualized code, anti-debug tricks, large protected section \| No — dynamic analysis required \|
114	\| VMProtect \| `.vmp0`/`.vmp1` sections, custom VM bytecode, heavy anti-tamper \| No — dynamic analysis required \|
115	\| ASPack \| `.aspack` section, low import count, `aSPack` string in binary \| Partially — tools available \|
116	\| MPRESS \| `.MPRESS1`/`.MPRESS2` sections, LZMA compression \| Partially — tools available \|
117	\| Enigma Protector \| `.enigma1`/`.enigma2` sections, license-check stubs \| No — dynamic analysis required \|
118	\| Custom packer \| Unknown section names, high entropy, minimal imports, no recognizable signature \| No — dynamic analysis required \|
119
120	What to Do When Packing is Detected:
121
122	1. Document packing in triage findings — Note the packer name (if identified), entropy values per section, and import count
123	2. Attempt UPX unpacking if applicable:
124	```bash
125	upx -d packed_sample.exe -o unpacked_sample.exe
126	# Verify unpacking succeeded
127	python scripts/hash_calculator.py unpack

People who liked this also viewed

6 picks

Type

malware-triage

43stars3forks

View on GitHub

How to install malware-triage?

gl0bal01/malware-analysis-claude-skills/malware-triage

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-triage

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Malware Triage
2
3	Systematic workflow for rapid malware assessment, classification, and prioritization for professional malware analysis and enterprise security operations.
4
5	## When to Use This Skill
6
7	Use this skill when the user needs to:
8	- Perform initial assessment of malware samples
9	- Quickly classify and prioritize samples
10	- Identify key indicators without deep analysis
11	- Decide whether to proceed with full analysis
12	- Triage multiple samples efficiently
13	- Create initial findings summary
14	- Predict malware behaviors before dynamic analysis
15
16	## Overview
17
18	Triage is the critical first phase of malware analysis that:
19	1. Quickly identifies key characteristics
20	2. Classifies malware type and threat level
21	3. Determines analysis priority
22	4. Predicts behaviors to guide deeper analysis
23	5. Extracts immediate IOCs
24
25	Goal: Make informed decisions about analysis approach within 5-30 minutes per sample.
26
27	## Triage Workflow
28
29	### Phase 1: Basic Information Gathering (5 minutes)
30
31	Calculate Hashes:
32	```bash
33	python scripts/hash_calculator.py sample.exe
34	```
35
36	Document:
37	- MD5, SHA1, SHA256
38	- Original filename
39	- File size
40	- File type (PE32/PE64/Script/Document)
41
42	Check Online Reputation:
43	- VirusTotal (virustotal.com)
44	- MalwareBazaar (bazaar.abuse.ch)
45	- Hybrid Analysis
46	- Any.Run
47
48	Record:
49	- Detection rate
50	- Known family name (if identified)
51	- Previous submission dates
52	- Community comments
53
54	### Phase 2: Quick Static Analysis (10 minutes)
55
56	For PE Files:
57	1. Check packing/obfuscation
58	- Use Detect It Easy (DIE) or PEiD
59	- Check entropy (>7.0 = likely packed)
60	- Document packer name if identified
61
62	2. Examine PE structure
63	- Compilation timestamp
64	- Section names and characteristics
65	- Digital signature status
66	- Entry point location
67	- Overlay data presence
68
69	3. Review import table
70	- See `references/indicators.md` for suspicious APIs
71	- Note process injection functions
72	- Note network functions
73	- Note anti-analysis functions
74
75	4. Extract strings
76	- URLs and IP addresses
77	- File paths
78	- Registry keys
79	- Mutex names
80	- Error messages
81	- Email addresses
82
83	For Scripts (PowerShell, VBS, JavaScript):
84	1. Check obfuscation level
85	2. Look for Base64/hex encoding
86	3. Identify download/execute patterns
87	4. Extract URLs and IPs
88	5. Check for embedded payloads
89
90	For Office Documents:
91	1. Check for macros
92	2. Examine OLE streams
93	3. Look for external references
94	4. Check metadata
95	5. Identify exploit indicators
96
97	### Packed Sample Handling
98
99	When a sample is packed or protected, static analysis yields limited results. Identify and document packing before proceeding.
100
101	Identify Packing:
102	- Entropy analysis — Overall entropy >7.0 or individual sections with entropy >6.8 strongly indicate packing or encryption
103	- Import table — Very few imports, or imports limited to `LoadLibrary` / `GetProcAddress` / `VirtualAlloc` / `VirtualProtect` (runtime loading pattern)
104	- Section names — Known packer section names: `UPX0`, `UPX1`, `UPX2` (UPX); `.themida`, `.winlicence` (Themida/WinLicense); `.vmp0`, `.vmp1` (VMProtect); `.aspack` (ASPack); `.MPRESS1`, `.MPRESS2` (MPRESS)
105	- Section characteristics — Executable sections with no readable strings, or a single large section combining code and data
106	- PE anomalies — Entry point outside the first section, missing standard sections (`.text`, `.data`, `.rsrc`), or unusually small code section
107
108	Common Packers and Indicators:
109
110	\| Packer \| Key Indicators \| Reversible? \|
111	\|--------\|----------------\|-------------\|
112	\| UPX \| `UPX0`/`UPX1` sections, high entropy, `UPX!` magic in overlay \| Yes — `upx -d sample.exe` \|
113	\| Themida / WinLicense \| `.themida` section, virtualized code, anti-debug tricks, large protected section \| No — dynamic analysis required \|
114	\| VMProtect \| `.vmp0`/`.vmp1` sections, custom VM bytecode, heavy anti-tamper \| No — dynamic analysis required \|
115	\| ASPack \| `.aspack` section, low import count, `aSPack` string in binary \| Partially — tools available \|
116	\| MPRESS \| `.MPRESS1`/`.MPRESS2` sections, LZMA compression \| Partially — tools available \|
117	\| Enigma Protector \| `.enigma1`/`.enigma2` sections, license-check stubs \| No — dynamic analysis required \|
118	\| Custom packer \| Unknown section names, high entropy, minimal imports, no recognizable signature \| No — dynamic analysis required \|
119
120	What to Do When Packing is Detected:
121
122	1. Document packing in triage findings — Note the packer name (if identified), entropy values per section, and import count
123	2. Attempt UPX unpacking if applicable:
124	```bash
125	upx -d packed_sample.exe -o unpacked_sample.exe
126	# Verify unpacking succeeded
127	python scripts/hash_calculator.py unpack

People who liked this also viewed

6 picks

Type