{"enrichment":{"faq":[{"a":"Malware Analysis covers systematic reverse-engineering workflows to unpack obfuscated loaders and recover real payloads. Start with static triage\u2014disassemble binaries, identify packing signatures, and apply deobfuscation techniques for .NET and native code. Use debuggers to step through unpacking stubs, then extract the decrypted payload. Malware Analysis guides you through each phase, from recognizing obfuscation patterns to safely isolating the true malware capabilities.","q":"How to reverse engineer malware and unpack obfuscated samples?"},{"a":"Malware Analysis outlines a static triage workflow that begins with binary metadata inspection, entropy analysis, and import table review to classify samples without execution. Generate YARA detection rules from your findings to catch similar variants. Map observed techniques to ATT&CK, extract indicators of compromise (IOCs), and document behavioral signatures. This approach lets you safely assess unknown binaries and build repeatable detection logic before any dynamic analysis.","q":"What is the malware analysis workflow for static triage?"},{"a":"Malware Analysis teaches C2 configuration extraction from beacon samples using memory forensics, pcap analysis, and config parsers. Analyze beacon cadence patterns, JA4 fingerprinting, and traffic signatures to identify command-and-control communications. Inspect memory dumps with Volatility 3 to recover in-memory C2 settings. Malware Analysis shows how to correlate beacon behavior with ATT&CK techniques and generate behavioral indicators for detection rules.","q":"How do you extract C2 config from beacon and detect command-and-control beaconing?"},{"a":"Malware Analysis covers memory forensics techniques to detect fileless malware and in-memory payloads using Volatility 3 and memory dump analysis. Identify suspicious process injection, shellcode patterns, and encrypted payloads resident in RAM. Analyze AMSI and ETW bypass attempts to understand evasion tactics. Extract artifacts without touching disk, then map findings to ATT&CK behaviors and generate low-false-positive detection rules from your observations.","q":"How can malware analysis detect fileless and in-memory malware artifacts?"},{"a":"Malware Analysis guides you through sandbox detonation workflows, capa framework integration for capability mapping, and safe sample handling. Use isolated environments to trigger malware behavior, capture network traffic (pcap), and collect memory dumps. Correlate sandbox telemetry with static findings to validate your reverse-engineering results and confirm payload recovery before authoring final detection rules.","q":"What tools and frameworks does malware analysis recommend for safe detonation?"},{"a":"Malware Analysis teaches YARA rule writing by extracting static signatures, byte patterns, and behavioral indicators from your reverse-engineering work. Author rules with low false-positive rates by combining entropy checks, import hashes, and string patterns unique to each malware family. Validate rules against known samples and variants, then integrate them into your detection pipeline alongside IOCs and ATT&CK mappings.","q":"How do you generate YARA rules for malware detection from analysis findings?"}],"shadow_tags":["threat-intel-extraction","binary-unpacking","network-ioc-detection","memory-forensics","c2-profiling","defensive-automation","payload-recovery","evasion-technique-mapping"],"summary_rewrite":"Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings."},"files":[{"bytes":9177,"path":"skills/malware-analysis/SKILL.md","sha256":"5106ffb534cfdd49d17e93620065842cbfe5cbe84b1117ac89759d09cd518657","url":"https://skillfed.io/files/hypnguyen1209/offensive-claude/malware-analysis/55009d5b/SKILL.md"}],"id":"hypnguyen1209/offensive-claude/malware-analysis","links":{"html":"https://skillfed.io/hypnguyen1209/offensive-claude/malware-analysis","md":"https://skillfed.io/hypnguyen1209/offensive-claude/malware-analysis.md","repo":"https://github.com/hypnguyen1209/offensive-claude"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":58,"language":"Python","last_updated":"2026-07-03","license":"MIT","name":"malware-analysis","publisher":"hypnguyen1209","stars":326},"relations":{"similar":[{"id":"hypnguyen1209/offensive-claude/threat-hunting"},{"id":"hypnguyen1209/offensive-claude/reverse-engineering"},{"id":"trailofbits/skills/yara-rule-authoring"},{"id":"infragate/capa/capabilities-manager"},{"id":"infragate/capa/bootstrap"},{"id":"synthetic-sciences/openscience/iso-13485-certification"},{"id":"LeonChaoX/qinyan-academic-skills/iso-13485-certification"},{"id":"foryourhealth111-pixel/Vibe-Skills/iso-13485-certification"},{"id":"affaan-m/ECC/quality-nonconformance"},{"id":"DrugClaw/DrugClaw/medical-qms-tools"}]},"slug":{"owner":"hypnguyen1209","repo":"offensive-claude","skill":"malware-analysis"},"version":"55009d5b"}