extracting-and-classifying-strings

Name: extracting-and-classifying-strings
Author: meltedinhex

18stars5forks

How to install extracting-and-classifying-strings?

meltedinhex/analyst-ai-pack/extracting-and-classifying-strings

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-and-classifying-strings

Installs into the current project.

Summary

Extracts ASCII and Unicode strings from a binary and classifies them into

Files · 1

View on GitHub

SKILL.md

1	# Extracting and Classifying Strings
2
3	## When to Use
4
5	- You are triaging a sample and want quick investigative leads from its readable strings.
6	- You need both ASCII and UTF-16LE (Unicode) strings, which many tools miss by default.
7	- You want strings grouped by meaning (URLs, paths, registry, commands) rather than a flat dump.
8
9	Do not use plaintext strings as the whole story for packed/obfuscated samples — the useful
10	strings may be encrypted; pair with entropy checks and deobfuscation (FLOSS) when the dump is
11	sparse.
12
13	## Prerequisites
14
15	- Python (stdlib) or `strings`/FLOSS; the sample handled inertly in the lab.
16
17	## Safety & Handling
18
19	- Extract strings from the inert file; never execute the sample.
20	- Defang any URLs/IPs before putting them in a report or ticket.
21
22	## Workflow
23
24	### Step 1: Extract ASCII and Unicode strings
25
26	Pull printable runs at a minimum length (default 4–5) for both ASCII and UTF-16LE encodings to
27	avoid missing Windows wide strings.
28
29	```bash
30	python scripts/analyst.py strings sample.bin --min-len 5
31	```
32
33	### Step 2: Classify by category
34
35	Bucket strings into URLs, IPs, domains, file paths, registry keys, mutex/event names, suspicious
36	commands, and API names so leads surface immediately.
37
38	### Step 3: Prioritize leads
39
40	Promote network indicators, command lines, and suspicious API references to the top; defang
41	network artifacts for safe handling.
42
43	### Step 4: Recognize obfuscation
44
45	A near-empty or junk-only dump signals packing/string obfuscation; route to entropy analysis and
46	FLOSS/manual deobfuscation.
47
48	## Validation
49
50	- Both ASCII and Unicode strings are extracted (Windows wide strings are not missed).
51	- Strings are grouped into useful categories, not a flat list.
52	- A sparse/garbage dump is correctly read as an obfuscation signal, not "clean".
53
54	## Pitfalls
55
56	- Extracting ASCII only and missing UTF-16LE strings.
57	- Treating a packed sample's empty dump as benign.
58	- Reporting live URLs/IPs without defanging.
59
60	## References
61
62	- See [`references/api-reference.md`](references/api-reference.md) for the string extractor.
63	- binutils strings and FLOSS (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

extracting-and-classifying-strings

18stars5forks

View on GitHub

How to install extracting-and-classifying-strings?

meltedinhex/analyst-ai-pack/extracting-and-classifying-strings

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-and-classifying-strings

Installs into the current project.

Summary

Extracts ASCII and Unicode strings from a binary and classifies them into

Files · 1

View on GitHub

SKILL.md

1	# Extracting and Classifying Strings
2
3	## When to Use
4
5	- You are triaging a sample and want quick investigative leads from its readable strings.
6	- You need both ASCII and UTF-16LE (Unicode) strings, which many tools miss by default.
7	- You want strings grouped by meaning (URLs, paths, registry, commands) rather than a flat dump.
8
9	Do not use plaintext strings as the whole story for packed/obfuscated samples — the useful
10	strings may be encrypted; pair with entropy checks and deobfuscation (FLOSS) when the dump is
11	sparse.
12
13	## Prerequisites
14
15	- Python (stdlib) or `strings`/FLOSS; the sample handled inertly in the lab.
16
17	## Safety & Handling
18
19	- Extract strings from the inert file; never execute the sample.
20	- Defang any URLs/IPs before putting them in a report or ticket.
21
22	## Workflow
23
24	### Step 1: Extract ASCII and Unicode strings
25
26	Pull printable runs at a minimum length (default 4–5) for both ASCII and UTF-16LE encodings to
27	avoid missing Windows wide strings.
28
29	```bash
30	python scripts/analyst.py strings sample.bin --min-len 5
31	```
32
33	### Step 2: Classify by category
34
35	Bucket strings into URLs, IPs, domains, file paths, registry keys, mutex/event names, suspicious
36	commands, and API names so leads surface immediately.
37
38	### Step 3: Prioritize leads
39
40	Promote network indicators, command lines, and suspicious API references to the top; defang
41	network artifacts for safe handling.
42
43	### Step 4: Recognize obfuscation
44
45	A near-empty or junk-only dump signals packing/string obfuscation; route to entropy analysis and
46	FLOSS/manual deobfuscation.
47
48	## Validation
49
50	- Both ASCII and Unicode strings are extracted (Windows wide strings are not missed).
51	- Strings are grouped into useful categories, not a flat list.
52	- A sparse/garbage dump is correctly read as an obfuscation signal, not "clean".
53
54	## Pitfalls
55
56	- Extracting ASCII only and missing UTF-16LE strings.
57	- Treating a packed sample's empty dump as benign.
58	- Reporting live URLs/IPs without defanging.
59
60	## References
61
62	- See [`references/api-reference.md`](references/api-reference.md) for the string extractor.
63	- binutils strings and FLOSS (linked in frontmatter).

People who liked this also viewed

6 picks

Type