# Malware Analysis

> Windows PE malware analysis — kill chain, IOC extraction, MITRE ATT&CK mapping

- Skill: `buzzer-re/malware-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add buzzer-re/malware-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/buzzer-re/malware-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: buzzer-re (https://skillmd.com/u/buzzer-re)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/buzzer-re/malware-analysis

---

Task: Malware Analysis. You are analyzing a potentially malicious Windows PE binary. Defang all IOCs (hxxps://, [.]).

## Phase 0: Obfuscation Triage

Before analysis, check for obfuscation:
1. Decompile the entry point and a few key functions
2. If code is heavily obfuscated (opaque predicates, CFF, MBA): invoke `/deobfuscation` first
3. If very few readable strings in a large binary → strings are encrypted
4. Look for the string decode stub: a small function called before every string use
5. If strings are encrypted: trace the decode function, understand the algorithm (XOR, RC4, custom)

**Crypto constant hunting:** When you find RC4 S-box or AES constants via
search_strings, use xrefs_to on the constant's address (not the S-box
itself) → finds KSA/key schedule → decompile that → xrefs_to on it →
finds the encrypt/decrypt wrapper. Do NOT use hex pattern search for
KSA byte-swap — too many false positives.

## Phase 1: Reconnaissance

Use built-in tools for initial survey:
1. `get_binary_info` — format, architecture, size, function count
2. `list_imports` — group by DLL, identify capabilities:
   - WINHTTP/WININET = Network communication
   - CRYPT32/ADVAPI32 (Crypt*) = Cryptographic operations
   - GDI32 = Screenshot capture
   - ntdll = Low-level ops, possible direct syscalls
3. `list_strings` + `search_strings` — look for URLs, API paths, user agents, mutex names, file extensions, registry paths, app paths (Discord, Telegram, Chrome)
4. `list_exports` — exported functions and ordinals

Batch these calls: get_binary_info + list_imports + list_exports can run in parallel.

## Phase 2: Execution Flow

1. Decompile entry point / WinMain with `decompile_function`
2. Identify the execution sequence and lifecycle: init → config → steal → exfil → exit
3. Use `function_xrefs` to map the call graph from entry
4. Categorize functions: initialization, C2, stealing modules, exfiltration, cleanup

## Phase 3: Targeted Analysis — Kill Chain

**For network malware:**
- Trace: socket init → DNS resolution → connect → send/recv
- Identify C2 protocol (raw socket, HTTP, DNS tunneling)
- Extract C2 config (hardcoded IP/domain or decrypted)

**For loader/dropper:**
- Identify stage 2 location (resource, overlay, encrypted blob)
- Extract and decrypt if possible
- Check for process injection: VirtualAllocEx → WriteProcessMemory → CreateRemoteThread

**For stealers:**
- Identify targeted applications (browser paths, wallet files, credential stores)
- Trace data exfiltration path
- Check for browser DB access patterns: SQLite, LevelDB, Login Data, Cookies

**For RATs:**
- Identify command dispatcher (usually a switch/if-chain on received data)
- Map each command: file upload/download, screenshot, keylog, shell, persistence

## Phase 4: Persistence + Evasion

- Check registry keys (RegSetValueEx, service install, scheduled task)
- Check process injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread)
- Check anti-analysis: IsDebuggerPresent, timing checks, VM detection, CPUID
- Direct syscalls: Resolving ntdll via GetModuleHandleA + scanning for B8...0F05
- Most commodity stealers have NO persistence — document this explicitly

## Phase 5: Report

Produce a compact triage first (~12 lines), then offer a detailed report:
```
Binary:   mal.exe | PE x86-64 | 1519 funcs | 92 imports
Packing:  None (entropy <7.0 all sections)
Crypto:   RC4 x 5 constants
IAT:      KERNEL32 only — runtime LoadLibrary/GetProcAddress resolution
Targets:  Chrome, Brave, Edge
C2:       hxxps://example[.]com/api/config
Verdict:  Stealer. RC4 string enc, dynamic API resolution.
```

Include: classification, capabilities, IOCs (defanged), kill chain, MITRE ATT&CK mapping.

## Naming Conventions

- Functions: PascalCase verb-noun (InitializeGlobals, StealDiscordTokens, HttpPostRequest)
- Globals: camelCase with g_ prefix (g_bEnabled, g_pConfigStart, g_C2ServerUrl)
- Structs: PascalCase (BrowserConfig, C2ResponseData)

## Common Patterns

- **Browser theft**: CryptUnprotectData, SQLite, paths with "User Data", "Login Data", "Cookies"
- **Token theft**: LevelDB (Discord), tdata (Telegram), .vdf (Steam)
- **Dead drop resolver**: Fetching Steam/Telegram/Pastebin pages to extract real C2
- **Direct syscalls**: Resolving ntdll via GetModuleHandleA + scanning for B8...0F05
- **XOR + Base64**: Common for C2 config and payload delivery
- **API hashing**: CRC32/DJB2/FNV of API names, resolved at runtime via PEB walk