ctf-malware
ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.
ctf-malware helps you analyze malware samples using static and dynamic techniques for CTF challenges.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-24
ctf-malware helps you analyze malware samples using static and dynamic techniques for CTF challenges. ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.
Use it when
- ctf-malware equips you with both static and dynamic analysis approaches.
- Yes.
Verify before relying
Read SKILL.md below before installing (4 files). Open directory: indexed for reading, not audited.
Install
ljagiello/ctf-skills/ctf-malware · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to analyze obfuscated scripts with ctf-malware?
ctf-malware teaches deobfuscation methods for PowerShell, Python, and other scripting languages. The skill covers static analysis techniques using tools like Capstone for disassembly, plus dynamic analysis with strace and ltrace to trace system calls. You'll learn to identify obfuscation patterns, decrypt encoded payloads, and extract malicious logic from trojanized plugins and custom implementations.
What malware analysis techniques does ctf-malware cover?
ctf-malware equips you with both static and dynamic analysis approaches. Static techniques include PE binary reverse engineering, YARA rule creation for detection, and API hashing reverse lookup. Dynamic analysis covers memory forensics with Volatility, process injection detection, and sandbox behavior observation. The skill also addresses anti-analysis evasion detection and custom crypto protocol identification.
Can ctf-malware help with C2 traffic decryption?
Yes. ctf-malware guides you through extracting command-and-control indicators from network traffic using PCAP analysis and beacon identification. You'll learn decryption techniques for RC4 and AES encrypted communications, custom crypto protocol analysis, and malware configuration extraction from captured traffic. These methods help identify C2 servers and decode malicious commands.
How does ctf-malware address sandbox evasion detection?
ctf-malware teaches techniques to detect and bypass anti-analysis and sandbox evasion tactics. The skill covers VM sandbox detection methods, API hashing techniques used by malware, and process injection detection strategies. You'll learn to recognize evasion patterns and understand how malware avoids analysis, enabling you to circumvent these defenses in CTF scenarios.
What tools and formats does ctf-malware support?
ctf-malware covers analysis of PE binaries, .NET malware using dnspy, PyInstaller-packed executables, and shellcode. It integrates tools like YARA for detection rules, Volatility for memory forensics, Capstone for disassembly, and strace/ltrace for dynamic tracing. The skill also addresses PCAP analysis for network indicators and custom protocol reverse engineering.
Is ctf-malware suitable for CTF competition challenges?
Yes. ctf-malware is designed specifically for solving CTF challenges involving malware and forensics. It combines obfuscated code decryption, binary reverse engineering, network traffic analysis, and evasion detection into a cohesive framework. The skill prepares you for real competition scenarios requiring rapid malware dissection and indicator extraction under time pressure.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
CTF Malware & Network Analysis
Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
Prerequisites
Python packages (all platforms):
pip install yara-python pefile capstone oletools unicorn pycryptodome \
volatility3 dissect.cobaltstrike
Linux (apt): ```bash apt
(truncated - see the full file via the links below)
File tree — 4 files
ctf-malware/SKILL.md
ctf-malware/c2-and-protocols.md
ctf-malware/pe-and-dotnet.md
ctf-malware/scripts-and-obfuscation.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Analyze malware samples using static and dynamic techniques”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
This skill provides guidance on conducting authorized security analysis of antivirus systems and threat detection mechanisms. It emphasizes proper sandboxing, legitimate tools like VirusTotal and YARA rules, and ethical research practices rather than unauthorized bypass techniques.
More skills deep-analysis (Apache-2.0) · ctf-crypto (MIT) · ctf-pwn (MIT)