# Malware Analysis Internals

> Malware Analysis Internals

- Skill: `j4flmao/malware-analysis-internals` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/malware-analysis-internals`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/malware-analysis-internals/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/malware-analysis-internals

---

# Malware Analysis Internals

> [!WARNING]
> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**
> This skill is strictly for analyzing and dissecting malicious software to write IOCs (Indicators of Compromise), YARA rules, and update EDR behavioral signatures.

## 1. Skill Context
**Focus**: Anti-analysis tricks, packers/crypters, API hooking, process injection, rootkit theory.
**Triggers**: anti-debugging techniques, unpack malware, api hooking internals, rootkit stealth

## 2. Deep Dissection Mechanics
The agent must explain how malware authors attempt to evade detection and how to defeat those evasions.

### Anti-Debugging & Anti-VM
- **Environment Checks**: Malware querying `CPUID` for hypervisor bits, checking for specific MAC addresses (OUI), or looking for VMware/VirtualBox specific drivers and registry keys.
- **PEB (Process Environment Block)**: Manually traversing the PEB in assembly (e.g., `mov eax, fs:[30h]`) to check the `BeingDebugged` flag or the `NtGlobalFlag`, bypassing standard Windows API hooks on `IsDebuggerPresent()`.
- **Timing Attacks**: Using `rdtsc` (Read Time-Stamp Counter) to measure execution time. If execution takes too long, it assumes a human analyst is stepping through a debugger.

### Packers & Unpacking Theory
- **Mechanics**: The true payload is compressed/encrypted and packed inside a "stub". Upon execution, the stub allocates memory (`VirtualAlloc`), decrypts the payload into that memory, resolves necessary APIs, and jumps to the Original Entry Point (OEP).
- **Defeating Packers**: Setting hardware breakpoints (DR registers) on execution of the newly allocated memory regions, or dumping the process memory when `VirtualProtect` changes the region to `PAGE_EXECUTE_READ`.

### Rootkits & EDR Evasion
- **Direct System Calls (Syswhispers)**: Bypassing user-land EDR API hooks (e.g., hooked `NtAllocateVirtualMemory` in `ntdll.dll`) by manually pushing the syscall number into `EAX` and executing the `syscall` instruction directly, staying entirely under the radar of Ring-3 security tools.
- **Kernel-Level Evasion (Ring 0)**: DKOM (Direct Kernel Object Manipulation). Unlinking a malicious process from the `EPROCESS` active process links list, making it invisible to Task Manager and standard APIs while still receiving CPU cycles.

## 3. Output Format
- Provide the low-level API chains used by malware (e.g., `CreateToolhelp32Snapshot` -> `Process32First` -> `OpenProcess`).
- Explain how to bypass the anti-analysis trick (e.g., patching the binary, manipulating EFLAGS).
- Provide YARA rule concepts for the discussed behaviors.