malware-analysis-tr_skill

Overview

This skill automates a professional malware analysis workflow for PE executables and other suspicious files and produces analyst-grade threat reports with evidence-backed conclusions. It performs static inspection, threat intelligence triage, behavioral inference, packing and anti-analysis assessment, and produces prioritized recommendations. Reports emphasize confidence levels and actionable outcomes rather than raw data dumps.

How this skill works

On file upload the skill runs a series of static collectors to extract hashes, PE metadata, imports, strings, section entropy, and suspicious indicators. It cross-checks the sample against threat intelligence sources (VirusTotal, MalwareBazaar, ThreatFox, etc.), extracts IOCs, maps API patterns to likely behaviors, and assesses packing and anti-analysis artifacts. Finally it synthesizes findings into a structured report with capability, risk, confidence, and remediation guidance, linking every conclusion to the underlying evidence.

When to use it

• You receive an unknown PE or suspicious attachment and need an analyst-grade assessment.
• A SOC analyst needs prioritized detection and containment guidance for a suspicious binary.
• Threat intel triage: determine if a sample is known malware or a new variant.
• Prioritize incident response actions after initial containment.
• Produce defensible findings for stakeholders or to support remediation.

Best practices

• Always include the raw static outputs (hashes, imports, entropy) as evidence when reporting conclusions.
• State confidence and justify it with specific findings (APIs, TI detections, packing indicators).
• If packing or low visibility is detected, recommend dynamic analysis before final attribution.
• Map APIs and strings to capabilities; avoid asserting capabilities without at least two supporting indicators.
• Provide concise remediation and detection steps tied to the observed capabilities.

Example use cases

• Detecting credential theft capability when CryptUnprotectData or browser-related APIs are present.
• Identifying process injection by correlating VirtualAlloc, VirtualProtect, WriteProcessMemory, CreateRemoteThread.
• Triage: distinguishing a well-known family (high VT detections + repo hits) from a new obfuscated sample requiring sandboxing.
• Building IOC lists (hashes, domains, registry keys) for blocking and hunting.
• Guiding incident response with immediate actions and prioritized detection opportunities.