# Malware Analysis

> Use when characterising a malware sample, the user asks "what does this binary do?" / "analyse this hash deeply", or `/hash-investigation` flags a novel sample warranting deeper review. Static + dynamic methodology, behavioural indicators, sandbox interpretation.

- Skill: `liberty91ltd/malware-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add liberty91ltd/malware-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/liberty91ltd/malware-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Liberty91LTD (https://skillmd.com/u/liberty91ltd)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/liberty91ltd/malware-analysis

---


# Malware Analysis Guide

This skill provides analytical guidance for understanding malware samples. It does NOT execute malware — it tells you what to look for in analysis reports, sandbox results, and VirusTotal data.

## Static Analysis

### PE Header Analysis
- **Compilation timestamp**: When was it compiled? Anomalous dates suggest timestomping.
- **Sections**: Unusual section names (not .text/.data/.rss/.reloc) suggest packing or custom builders.
- **Entropy**: High entropy (>7.0) in sections suggests encryption or compression (packed).
- **Imports**: Key suspicious imports indicate behavior:

| Import | Indicates |
|--------|----------|
| VirtualAlloc, VirtualProtect | Memory manipulation (injection, unpacking) |
| CreateRemoteThread, WriteProcessMemory | Process injection (T1055) |
| RegSetValueEx, RegCreateKeyEx | Registry persistence (T1547) |
| InternetOpenUrl, HttpSendRequest | Network communication (T1071) |
| CryptEncrypt, CryptDecrypt | Encryption (ransomware or C2 encryption) |
| CreateService, StartService | Service persistence (T1543) |
| AdjustTokenPrivileges | Privilege escalation (T1134) |
| IsDebuggerPresent, CheckRemoteDebuggerPresent | Anti-analysis (T1622) |

### String Analysis
Look for:
- URLs, IP addresses, domain names (C2 infrastructure)
- File paths (drop locations, persistence targets)
- Registry keys (persistence mechanisms)
- User-Agent strings (C2 communication patterns)
- Encryption keys or encoded data
- Error messages or debug strings (developer artifacts)
- Mutex names (used to prevent multiple instances)

### Packer Identification
Common packers: UPX, Themida, VMProtect, ASPack, MPRESS. Packed samples need unpacking before full static analysis. High entropy + few meaningful strings = likely packed.

## Dynamic Analysis (Sandbox Interpretation)

### Process Behavior
- Child processes spawned (especially cmd.exe, powershell.exe, wscript.exe)
- Process injection into legitimate processes (svchost, explorer, lsass)
- Privilege escalation attempts
- Anti-analysis checks (VM detection, sandbox detection, timing checks)

### File System Activity
- Files dropped (where? what type?)
- Files modified (host files, configuration files)
- Files deleted (covering tracks, removing competitors)

### Registry Activity
- Run/RunOnce keys (persistence)
- Service creation (persistence)
- Firewall rule modification (defense evasion)
- Security tool disabling

### Network Activity
- DNS queries (C2 domains, DGA-generated domains)
- HTTP/HTTPS connections (C2 communication, data exfiltration)
- Raw TCP/UDP connections (custom protocol C2)
- Certificate information (self-signed = suspicious)

## Analysis Output Template

```markdown
## Malware Analysis: [Sample Name/Hash]

### Sample Information
- SHA-256: [hash]
- File type: [PE/ELF/document/script]
- File size: [bytes]
- First seen: [date]
- Detection ratio: [X/Y from VT]
- Family: [if identified]

### Static Analysis Findings
- Compilation: [timestamp, language, compiler]
- Packing: [packer identified or unpacked]
- Key imports: [suspicious APIs]
- Notable strings: [C2, paths, keys, mutexes]

### Dynamic Behavior
- Execution chain: [parent → child processes]
- Persistence: [mechanism and location]
- C2 communication: [protocol, destination, pattern]
- Data collection: [what data is targeted]
- Defense evasion: [anti-analysis, obfuscation]

### MITRE ATT&CK Mapping
| Tactic | Technique | Observed Behavior |
|--------|-----------|-------------------|

### IOCs Extracted
| Type | Value | Context |
|------|-------|---------|

### Assessment
[What is this malware? What does it do? Who might use it? Confidence level.]
```

## Tooling for the sections above

When the sample is available in ReversingLabs Spectra Analyze (A1000), `/lookup-reversinglabs report <hash> --detailed` is the single richest source for almost everything on this page — it returns vendor-authoritative classification, TitaniumCore static analysis (headers, imports, strings, packer detection), `attack` (auto-mapped MITRE ATT&CK tactics + techniques from observed behaviour), `rl_cloud_sandbox` (dynamic analysis output), and `networkthreatintelligence` (C2 indicators extracted from the sample). Use it to pre-fill the **MITRE ATT&CK Mapping** and **IOCs Extracted** tables in the output template before doing your own analysis. Pivot to siblings in the same family with `/lookup-reversinglabs search 'threatname:<family> classification:malicious'`, and to parent/child relationships with `containers` / `extracted`.

## Related skills

- **Sample triage before deep analysis** — `/hash-investigation` for VT detection ratio, family attribution, behaviour tags, and pre-existing community context. If detection is high and family is known, the lookup may be sufficient.
- **Vendor-authoritative analysis** — `/lookup-reversinglabs report <hash> --detailed` for classification, MITRE ATT&CK mapping, sandbox, and network indicators in a single call. Run this whenever RL credentials are configured — it shortcuts most of the manual static + dynamic interpretation below.
- **C2 and infrastructure extraction** — `/lookup-virustotal file <hash> --relationships contacted_ips,contacted_domains,contacted_urls,communicating_files,dropped_files,parent_files` (VT) and `/lookup-reversinglabs report <hash> --fields networkthreatintelligence` (RL); pivot each via `/indicator-pivoting`
- **Vendor actor attribution** — `/lookup-crowdstrike indicator <hash>` for the threat actors and malware family CrowdStrike Falcon Intel links to the sample, plus report references; then `/lookup-crowdstrike ttps <actor>` to pull that actor's ATT&CK technique set into the **MITRE ATT&CK Mapping** table. Run whenever CrowdStrike credentials are configured.
- **Community attribution** — `/lookup-otx file <hash>` for pulses and YARA matches
- **First-party correlation** — `/lookup-liberty91 ioc-lookup <hash>` for the platform's own verdict, then `library malware --name "<family>"` (or `--alias` for a vendor's name) and `entity malware <id> --section techniques|iocs|threat-events` for the canonical family record: dated ATT&CK observations, associated indicators, and the occurrences the family has been named in
- **Internal correlation** — `/lookup-misp search-attributes --value <hash>` and/or `/lookup-opencti lookup <hash>` to surface prior catalogued intel; if the analysis produces new indicators worth keeping, `/lookup-misp add-attribute` / `create-event` and/or `/lookup-opencti create-indicator`
- **Ransomware-family lineage** — `/lookup-ransomwarelive yara <group>` and `iocs <group>` provide a curated reference set if VT family classification points to a known group
- **Detection authoring** — `/yara-writing` for family/sample rules; `/sigma-writing` for behavioural detection
- **Apply rigor** — `/score-source`, `/apply-tlp`, `/confidence-language`