# Malware Ctf

> Lab/CTF: malware-analysis challenges; obfuscated scripts, PE/.NET/ELF, shellcode artifacts, memory/PCAP, configs, encrypted traffic.

- Skill: `aeondave/malware-ctf` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add aeondave/malware-ctf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/malware-ctf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/malware-ctf

---


# Malware CTF

Goal: solve malware-analysis challenge solving tasks with professional offensive methodology, preserved imported technique coverage, and reproducible evidence.

## When this skill applies

- obfuscated scripts, PE/.NET/ELF samples, shellcode, injected memory, malware PCAPs, C2 configs, or encrypted protocol traffic
- config extraction, unpacking, API hashing, C2 reconstruction, memory dumping, or network-protocol decoding

## Operating model

1. Classify the dominant artifact, primitive, or objective.
2. Load the closest `offensive-techniques` methodology before selecting tools.
3. Load debrandized imported references only for deep technique details.
4. Choose the smallest tool chain that can produce a validation signal.
5. Record the exact proof path and stop once the objective is reproducible.

## Technique integration

Primary methodology to load:

- `reversing-technique`
- `forensic-technique`
- `network-technique`
- `crypto-technique`

Use these as decision engines. This skill adds challenge-oriented triage, time-boxing, and preserved specialized patterns from the imported corpus.

## Tool routing

Prefer these tool families when the corresponding signal appears:

- `capa`
- `yara`
- `volatility3`
- `ghidra`
- `x64dbg`
- `frida`
- `wireshark`

Tool syntax belongs in the tool skills. This skill decides when a tool family fits and what output should validate progress.

## Solving patterns

- Favor artifact-first triage, shortest reproducible path, and explicit validation signal before pivoting.
- Record failed hypotheses with evidence so an agent does not repeat expensive dead paths.
- Prefer category-specific tools after surface classification instead of running every scanner or brute-forcer by habit.
- End with a replayable proof: recovered secret, local verification, exploit output, decoded artifact, or correlated evidence chain.

## Category-specific quick pivots

- Static triage before execution: file type, entropy, imports, strings, capabilities, embedded blobs.
- Run dynamic analysis only in isolation and record file, process, registry, and network effects.
- Treat encrypted configs and C2 protocols as crypto/protocol-reversing subproblems.

## Quality gates

- No claim without a validation signal: recovered secret, replayed exploit, decoded artifact, reproduced model behavior, or corroborated evidence.
- Do not brute force before representation, constraints, and success oracle are known.
- Keep a pivot ledger: hypothesis, evidence, result, next shortest path.
- Keep challenge/platform/competition names out of notes and generated reports.

## Resources

- [references/c2-and-protocols.md](references/c2-and-protocols.md) — preserved, debrandized imported technique material.
- [references/pe-and-dotnet.md](references/pe-and-dotnet.md) — PE/NET static analysis patterns, config extraction, sandbox evasion signatures, DNS C2.
- [references/scripts-and-obfuscation.md](references/scripts-and-obfuscation.md) — preserved, debrandized imported technique material.
- [references/static-and-dynamic-triage.md](references/static-and-dynamic-triage.md) — Load for systematic malware triage: file ID → strings → capa → PE header → import analysis → packing/obfuscation resolution → dynamic analysis and validation.