CTF Malware & Network Analysis
Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
Additional Resources
- scripts-and-obfuscation.md - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection)
- c2-and-protocols.md - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
- pe-and-dotnet.md - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor
Pattern Recognition Index
Dispatch on byte/file signals, never the sample's reputation.
| Signal |
Technique → file |
File starts with PK + contains package.json + .vsix extension |
VSCode extension activation-event exfil → scripts-and-obfuscation.md |
High-entropy extension.js/index.js > 50 KB with child_process |
JS obfuscator.io / JSFuck deobfuscation → scripts-and-obfuscation.md |
PowerShell -enc <b64> or IEX in parent process logs |
PS script decode + reflection assembly → scripts-and-obfuscation.md |
| PCAP with custom TCP port, payload bytes distributed uniformly |
Custom crypto / RC4 / AES session key recovery → c2-and-protocols.md |
PCAP with DNS TXT records carrying base32/64 blobs |
DNS-based C2 exfil → c2-and-protocols.md |
| PCAP where specific User-Agent receives non-default responses |
UA-gated C2 path-hex-XOR → (see ctf-forensics/network-advanced.md) |
PE32/PE64 with .text sections having packer signatures (UPX, VMProtect, Themida) |
Unpacking + dump-after-decrypt → pe-and-dotnet.md |
| .NET assembly with obfuscated strings + reflection calls |
dnSpy + de4dot + string decryption → pe-and-dotnet.md |
PyInstaller binary (MEIPASS, _MEIxxxx strings) |
pyinstxtractor + pycdc → pe-and-dotnet.md |
Process-injection IoCs in memory dump (RWX allocations, NtUnmapViewOfSection) |
Volatility malfind + process hollowing detection → scripts-and-obfuscation.md |
Anti-VM checks (cpuid hypervisor bit, RDTSC timing, specific drivers) |
VM-detection bypass in analysis sandbox → scripts-and-obfuscation.md |
| WebSocket frame with visible RC4 key-setup or KSA signatures |
RC4 WebSocket reversing → c2-and-protocols.md |
Recognize the artefact or protocol pattern. The sample's name is not a signal.
For inline snippets and quick-reference tables, see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first.
1---2name: ctf-malware3description: CTF Malware & Network Analysis4---56# CTF Malware & Network Analysis78Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.910## Additional Resources1112- [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection)13- [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption14- [pe-and-dotnet.md](pe-and-dotnet.md) - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor1516---1718## Pattern Recognition Index1920Dispatch on **byte/file signals**, never the sample's reputation.2122| Signal | Technique → file |23|---|---|24| File starts with `PK` + contains `package.json` + `.vsix` extension | VSCode extension activation-event exfil → scripts-and-obfuscation.md |25| High-entropy `extension.js`/`index.js` > 50 KB with `child_process` | JS obfuscator.io / JSFuck deobfuscation → scripts-and-obfuscation.md |26| PowerShell `-enc <b64>` or IEX in parent process logs | PS script decode + reflection assembly → scripts-and-obfuscation.md |27| PCAP with custom TCP port, payload bytes distributed uniformly | Custom crypto / RC4 / AES session key recovery → c2-and-protocols.md |28| PCAP with `DNS TXT` records carrying base32/64 blobs | DNS-based C2 exfil → c2-and-protocols.md |29| PCAP where specific User-Agent receives non-default responses | UA-gated C2 path-hex-XOR → (see ctf-forensics/network-advanced.md) |30| PE32/PE64 with `.text` sections having packer signatures (UPX, VMProtect, Themida) | Unpacking + dump-after-decrypt → pe-and-dotnet.md |31| .NET assembly with obfuscated strings + reflection calls | dnSpy + de4dot + string decryption → pe-and-dotnet.md |32| PyInstaller binary (`MEIPASS`, `_MEIxxxx` strings) | pyinstxtractor + pycdc → pe-and-dotnet.md |33| Process-injection IoCs in memory dump (`RWX` allocations, `NtUnmapViewOfSection`) | Volatility `malfind` + process hollowing detection → scripts-and-obfuscation.md |34| Anti-VM checks (`cpuid` hypervisor bit, RDTSC timing, specific drivers) | VM-detection bypass in analysis sandbox → scripts-and-obfuscation.md |35| WebSocket frame with visible RC4 key-setup or KSA signatures | RC4 WebSocket reversing → c2-and-protocols.md |3637Recognize the **artefact or protocol pattern**. The sample's name is not a signal.3839---4041---4243For inline snippets and quick-reference tables, see [quickref.md](quickref.md). The Pattern Recognition Index above is the dispatch table — always consult it first.
MateoBogo