ctf-malware
ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.
ctf-malware helps you analyze malware samples using static and dynamic techniques for CTF challenges.
AI-generated summary based on this skill's SKILL.md
Install
ljagiello/ctf-skills/ctf-malware · repository language: Python
git clone https://github.com/ljagiello/ctf-skills
cp -r ctf-skills/ctf-malware ~/.claude/skills/ctf-malwarenpx skillfed install ljagiello/ctf-skills/ctf-malwareFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to analyze obfuscated scripts with ctf-malware?
ctf-malware teaches deobfuscation methods for PowerShell, Python, and other scripting languages. The skill covers static analysis techniques using tools like Capstone for disassembly, plus dynamic analysis with strace and ltrace to trace system calls. You'll learn to identify obfuscation patterns, decrypt encoded payloads, and extract malicious logic from trojanized plugins and custom implementations.
What malware analysis techniques does ctf-malware cover?
ctf-malware equips you with both static and dynamic analysis approaches. Static techniques include PE binary reverse engineering, YARA rule creation for detection, and API hashing reverse lookup. Dynamic analysis covers memory forensics with Volatility, process injection detection, and sandbox behavior observation. The skill also addresses anti-analysis evasion detection and custom crypto protocol identification.
Can ctf-malware help with C2 traffic decryption?
Yes. ctf-malware guides you through extracting command-and-control indicators from network traffic using PCAP analysis and beacon identification. You'll learn decryption techniques for RC4 and AES encrypted communications, custom crypto protocol analysis, and malware configuration extraction from captured traffic. These methods help identify C2 servers and decode malicious commands.
How does ctf-malware address sandbox evasion detection?
ctf-malware teaches techniques to detect and bypass anti-analysis and sandbox evasion tactics. The skill covers VM sandbox detection methods, API hashing techniques used by malware, and process injection detection strategies. You'll learn to recognize evasion patterns and understand how malware avoids analysis, enabling you to circumvent these defenses in CTF scenarios.
What tools and formats does ctf-malware support?
ctf-malware covers analysis of PE binaries, .NET malware using dnspy, PyInstaller-packed executables, and shellcode. It integrates tools like YARA for detection rules, Volatility for memory forensics, Capstone for disassembly, and strace/ltrace for dynamic tracing. The skill also addresses PCAP analysis for network indicators and custom protocol reverse engineering.
Is ctf-malware suitable for CTF competition challenges?
Yes. ctf-malware is designed specifically for solving CTF challenges involving malware and forensics. It combines obfuscated code decryption, binary reverse engineering, network traffic analysis, and evasion detection into a cohesive framework. The skill prepares you for real competition scenarios requiring rapid malware dissection and indicator extraction under time pressure.
SKILL.md
rendered from the published skill — quoted content, verbatim
CTF Malware & Network Analysis
Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
Prerequisites
Python packages (all platforms):
pip install yara-python pefile capstone oletools unicorn pycryptodome \
volatility3 dissect.cobaltstrike
Linux (apt): ```bash apt
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 4 files
ctf-malware/SKILL.md
ctf-malware/c2-and-protocols.md
ctf-malware/pe-and-dotnet.md
ctf-malware/scripts-and-obfuscation.md