05-malware-analysis

Name: 05-malware-analysis
Author: Masriyan

190stars37forks

How to install 05-malware-analysis?

masriyan/claude-code-cybersecurity-skill/05-malware-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 05-malware-analysis

Installs into the current project.

Summary

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

Files · 1

View on GitHub

SKILL.md

1	# Malware Analysis & Sandboxing
2
3	## Purpose
4
5	Enable Claude to assist with malware analysis workflows including static analysis of file properties and code, dynamic behavioral analysis interpretation, YARA rule generation, sandbox configuration, and malware family identification. Claude analyzes provided artifacts directly and orchestrates scripts for automated processing.
6
7	> Safety Warning: Never execute suspicious files outside of isolated, controlled environments. Use dedicated VMs or sandboxes with network isolation and snapshot capability.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Analyzing a suspicious file, binary, or script
15	- Generating YARA rules for malware detection
16	- Setting up a malware analysis sandbox
17	- Interpreting Cuckoo/CAPE/AnyRun sandbox reports
18	- Identifying malware family or behavior
19	- Creating IOCs from malware samples
20	- Static analysis of PE/ELF files
21	- Memory forensics for malware artifacts
22	- Behavioral analysis (process creation, network, registry, file changes)
23
24	---
25
26	## Prerequisites
27
28	```bash
29	pip install yara-python pefile python-magic requests ssdeep
30	```
31
32	Recommended analysis tools:
33	- `Cuckoo Sandbox / CAPE` — Automated dynamic analysis
34	- `VirusTotal API` — Multi-engine scanning and intel
35	- `YARA` — Pattern matching engine
36	- `Ghidra / IDA Pro` — Deep binary analysis (→ Skill 04)
37	- `Volatility 3` — Memory forensics
38	- `DIE (Detect-It-Easy)` — Packer/compiler detection
39	- `Pestudio` — Windows PE static analysis
40
41	---
42
43	## Core Capabilities
44
45	### 1. Static Malware Analysis
46
47	When the user provides a suspicious file or hash for analysis:
48
49	Claude performs analysis in this order:
50
51	Step 1 — File Identification:
52	```bash
53	file malware.exe # File type from magic bytes
54	md5sum malware.exe # MD5 hash (legacy, for lookups)
55	sha256sum malware.exe # SHA-256 (primary identifier)
56	python scripts/static_analyzer.py --file malware.exe --hashes
57	```
58
59	Step 2 — Threat Intelligence Lookup:
60	- Query VirusTotal (requires API key or paste hash in browser)
61	- Check MalwareBazaar, AbuseIPDB, URLhaus
62	- Search for existing analysis reports
63	```bash
64	# VirusTotal hash lookup via API
65	curl "https://www.virustotal.com/api/v3/files/<sha256>" -H "x-apikey: YOUR_KEY"
66	```
67
68	Step 3 — PE Analysis (Windows executables):
69	```bash
70	python scripts/static_analyzer.py --file malware.exe --strings --imports --output report.json
71	```
72
73	Look for these indicators in the output:
74
75	Suspicious Import Functions:
76	\| Category \| Suspicious APIs \|
77	\|----------\|----------------\|
78	\| Process Injection \| `CreateRemoteThread`, `WriteProcessMemory`, `VirtualAllocEx`, `NtMapViewOfSection`, `RtlCreateUserThread` \|
79	\| Persistence \| `RegSetValueEx`, `CreateService`, `SHFileOperation`, `ITaskScheduler` \|
80	\| Anti-Analysis \| `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, `GetTickCount`, `QueryPerformanceCounter`, `GetSystemInfo` \|
81	\| Network C2 \| `InternetOpenUrl`, `HttpSendRequest`, `WSAStartup`, `socket`, `URLDownloadToFile`, `WinHttpOpen` \|
82	\| Crypto Operations \| `CryptEncrypt`, `CryptDecrypt`, `BCryptEncrypt`, `CryptHashData` \|
83	\| Credential Access \| `SamOpenDatabase`, `LsaOpenPolicy`, `NtlmGetUserInfo` \|
84	\| Keylogging \| `SetWindowsHookEx`, `GetAsyncKeyState`, `GetKeyboardState` \|
85	\| Defense Evasion \| `VirtualProtect`, `NtSetInformationProcess`, `Wow64DisableWow64FsRedirection` \|
86
87	Step 4 — String Extraction & Analysis:
88	```bash
89	strings -a malware.exe \| grep -E "(http\|ftp\|/[a-z]\|[0-9]{1,3}\.[0-9]{1,3}\|HKEY\|reg\|cmd\|powershell)"
90	```
91
92	Categorize extracted strings:
93	- Network indicators: URLs, IPs, domains, user agents
94	- File system: paths, filenames, registry keys
95	- Crypto: base64 blobs, hex strings (potential keys/payloads)
96	- Anti-analysis: VM/sandbox detection strings (VMware, VirtualBox, Sandboxie)
97	- Mutex names: unique identifiers preventing double-infection
98
99	Step 5 — Entropy Analysis:
100	```bash
101	python scripts/static_analyzer.py --file malware.exe --entropy
102	```
103
104	\| Entropy Range \| Interpretation \|
105	\|---------------\|---------------\|
106	\| 0.0 – 1.0 \| Near-empty or all-zeros section \|
107	\| 1.0 – 5.0 \| Normal code/data section \|
108	\| 5.0 – 7.0 \| Compressed data or code \|
109	\| 7.0 – 8.0 \| Encrypted or packed data — investigate \|
110	\| 7.9 – 8.0 \| Highly suspicious — likely encrypted payload \|
111
112	### 2. YARA Rule Generation
113
114	When the user asks to create YARA rules from a sample or indicators:
115
116	Claude generates YARA rules following this methodology:
117
118	1. Select stable, unique indicators — Avoid generic patterns; choose bytes/strings unique to this family
119	2. Prefer structural patterns — Header magic bytes, specific offsets, section names
120	3. **Balance speci

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

05-malware-analysis

190stars37forks

View on GitHub

How to install 05-malware-analysis?

masriyan/claude-code-cybersecurity-skill/05-malware-analysis

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 05-malware-analysis

Installs into the current project.

Summary

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

Files · 1

View on GitHub

SKILL.md

1	# Malware Analysis & Sandboxing
2
3	## Purpose
4
5	Enable Claude to assist with malware analysis workflows including static analysis of file properties and code, dynamic behavioral analysis interpretation, YARA rule generation, sandbox configuration, and malware family identification. Claude analyzes provided artifacts directly and orchestrates scripts for automated processing.
6
7	> Safety Warning: Never execute suspicious files outside of isolated, controlled environments. Use dedicated VMs or sandboxes with network isolation and snapshot capability.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Analyzing a suspicious file, binary, or script
15	- Generating YARA rules for malware detection
16	- Setting up a malware analysis sandbox
17	- Interpreting Cuckoo/CAPE/AnyRun sandbox reports
18	- Identifying malware family or behavior
19	- Creating IOCs from malware samples
20	- Static analysis of PE/ELF files
21	- Memory forensics for malware artifacts
22	- Behavioral analysis (process creation, network, registry, file changes)
23
24	---
25
26	## Prerequisites
27
28	```bash
29	pip install yara-python pefile python-magic requests ssdeep
30	```
31
32	Recommended analysis tools:
33	- `Cuckoo Sandbox / CAPE` — Automated dynamic analysis
34	- `VirusTotal API` — Multi-engine scanning and intel
35	- `YARA` — Pattern matching engine
36	- `Ghidra / IDA Pro` — Deep binary analysis (→ Skill 04)
37	- `Volatility 3` — Memory forensics
38	- `DIE (Detect-It-Easy)` — Packer/compiler detection
39	- `Pestudio` — Windows PE static analysis
40
41	---
42
43	## Core Capabilities
44
45	### 1. Static Malware Analysis
46
47	When the user provides a suspicious file or hash for analysis:
48
49	Claude performs analysis in this order:
50
51	Step 1 — File Identification:
52	```bash
53	file malware.exe # File type from magic bytes
54	md5sum malware.exe # MD5 hash (legacy, for lookups)
55	sha256sum malware.exe # SHA-256 (primary identifier)
56	python scripts/static_analyzer.py --file malware.exe --hashes
57	```
58
59	Step 2 — Threat Intelligence Lookup:
60	- Query VirusTotal (requires API key or paste hash in browser)
61	- Check MalwareBazaar, AbuseIPDB, URLhaus
62	- Search for existing analysis reports
63	```bash
64	# VirusTotal hash lookup via API
65	curl "https://www.virustotal.com/api/v3/files/<sha256>" -H "x-apikey: YOUR_KEY"
66	```
67
68	Step 3 — PE Analysis (Windows executables):
69	```bash
70	python scripts/static_analyzer.py --file malware.exe --strings --imports --output report.json
71	```
72
73	Look for these indicators in the output:
74
75	Suspicious Import Functions:
76	\| Category \| Suspicious APIs \|
77	\|----------\|----------------\|
78	\| Process Injection \| `CreateRemoteThread`, `WriteProcessMemory`, `VirtualAllocEx`, `NtMapViewOfSection`, `RtlCreateUserThread` \|
79	\| Persistence \| `RegSetValueEx`, `CreateService`, `SHFileOperation`, `ITaskScheduler` \|
80	\| Anti-Analysis \| `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, `GetTickCount`, `QueryPerformanceCounter`, `GetSystemInfo` \|
81	\| Network C2 \| `InternetOpenUrl`, `HttpSendRequest`, `WSAStartup`, `socket`, `URLDownloadToFile`, `WinHttpOpen` \|
82	\| Crypto Operations \| `CryptEncrypt`, `CryptDecrypt`, `BCryptEncrypt`, `CryptHashData` \|
83	\| Credential Access \| `SamOpenDatabase`, `LsaOpenPolicy`, `NtlmGetUserInfo` \|
84	\| Keylogging \| `SetWindowsHookEx`, `GetAsyncKeyState`, `GetKeyboardState` \|
85	\| Defense Evasion \| `VirtualProtect`, `NtSetInformationProcess`, `Wow64DisableWow64FsRedirection` \|
86
87	Step 4 — String Extraction & Analysis:
88	```bash
89	strings -a malware.exe \| grep -E "(http\|ftp\|/[a-z]\|[0-9]{1,3}\.[0-9]{1,3}\|HKEY\|reg\|cmd\|powershell)"
90	```
91
92	Categorize extracted strings:
93	- Network indicators: URLs, IPs, domains, user agents
94	- File system: paths, filenames, registry keys
95	- Crypto: base64 blobs, hex strings (potential keys/payloads)
96	- Anti-analysis: VM/sandbox detection strings (VMware, VirtualBox, Sandboxie)
97	- Mutex names: unique identifiers preventing double-infection
98
99	Step 5 — Entropy Analysis:
100	```bash
101	python scripts/static_analyzer.py --file malware.exe --entropy
102	```
103
104	\| Entropy Range \| Interpretation \|
105	\|---------------\|---------------\|
106	\| 0.0 – 1.0 \| Near-empty or all-zeros section \|
107	\| 1.0 – 5.0 \| Normal code/data section \|
108	\| 5.0 – 7.0 \| Compressed data or code \|
109	\| 7.0 – 8.0 \| Encrypted or packed data — investigate \|
110	\| 7.9 – 8.0 \| Highly suspicious — likely encrypted payload \|
111
112	### 2. YARA Rule Generation
113
114	When the user asks to create YARA rules from a sample or indicators:
115
116	Claude generates YARA rules following this methodology:
117
118	1. Select stable, unique indicators — Avoid generic patterns; choose bytes/strings unique to this family
119	2. Prefer structural patterns — Header magic bytes, specific offsets, section names
120	3. **Balance speci

People who liked this also viewed

6 picks

Type