Perform Static Malware Analysis
Overview
Build a capability hypothesis from preserved bytes and structure. Keep every source-level or behavioral claim bounded by what static evidence can actually prove.
Read references/static-analysis-layers.md for layered checks and escalation criteria.
Workflow
- Establish artifact identity and working copy.
- Inspect outer structure.
- Identify formats, architectures, bundles, packages, sections, members, overlays, embedded resources, signatures, timestamps, and declared permissions.
- Extract low-risk indicators.
- Collect imports/exports, linked libraries, symbols, strings, URLs/domains, paths, commands, mutex/service names, configuration, certificates, and persistence references.
- Inspect code and content shape.
- Identify interpreters, entry points, packers/obfuscation, encrypted blobs, staged payloads, anti-analysis checks, and unusual executable mappings.
- Use YARA-X or other local rules as evidence with rule/version recorded.
- Form capability hypotheses.
- Map evidence to possible execution, persistence, discovery, credential, collection, command-and-control, exfiltration, or defense-evasion behavior.
- Separate present code from reachable behavior and capability from observed execution.
- Escalate deliberately.
- Use
reverse-engineering-skills for control flow, decompilation, protocol/config recovery, or exact binary comparisons.
- Use dynamic analysis only after isolation selection and a clear observation plan.
Output
Return identity, structure, indicators, likely capabilities, contradictory evidence, obfuscation/coverage limits, confidence, and the smallest next analysis step.
1---2name: perform-static-malware-analysis3description: Analyze a suspicious artifact without executing it. Use for binaries, apps, packages, archives, scripts, libraries, extensions, firmware, or payloads when metadata, signatures, imports, strings, resources, and obfuscation need inspection.4---56# Perform Static Malware Analysis78## Overview910Build a capability hypothesis from preserved bytes and structure. Keep every source-level or behavioral claim bounded by what static evidence can actually prove.1112Read [references/static-analysis-layers.md](references/static-analysis-layers.md) for layered checks and escalation criteria.1314## Workflow15161. Establish artifact identity and working copy.172. Inspect outer structure.18 - Identify formats, architectures, bundles, packages, sections, members, overlays, embedded resources, signatures, timestamps, and declared permissions.193. Extract low-risk indicators.20 - Collect imports/exports, linked libraries, symbols, strings, URLs/domains, paths, commands, mutex/service names, configuration, certificates, and persistence references.214. Inspect code and content shape.22 - Identify interpreters, entry points, packers/obfuscation, encrypted blobs, staged payloads, anti-analysis checks, and unusual executable mappings.23 - Use YARA-X or other local rules as evidence with rule/version recorded.245. Form capability hypotheses.25 - Map evidence to possible execution, persistence, discovery, credential, collection, command-and-control, exfiltration, or defense-evasion behavior.26 - Separate present code from reachable behavior and capability from observed execution.276. Escalate deliberately.28 - Use `reverse-engineering-skills` for control flow, decompilation, protocol/config recovery, or exact binary comparisons.29 - Use dynamic analysis only after isolation selection and a clear observation plan.3031## Output3233Return identity, structure, indicators, likely capabilities, contradictory evidence, obfuscation/coverage limits, confidence, and the smallest next analysis step.
gaelic-ghost