skills.rest
DexterJie
DexterJieCOMMUNITY
Explore all skills by this author →
GitHub

ctf-malware

Analyze malware and network traffic in CTF challenges.

Updated Apr 30, 2026
Search Tags:#binary analysis#network traffic analysis#CTF#malware analysis#malware deobfuscation
One-click install
npx skills add https://github.com/DexterJie/codex-skills --skill ctf-malware-dexterjie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-malware
Source: https://github.com/DexterJie/codex-skills/tree/main/ctf-malware
Command: npx skills add https://github.com/DexterJie/codex-skills --skill ctf-malware-dexterjie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-python, volatility3, dnSpy, pefile, capstone, oletools, unicorn, pycryptodome, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive suite of tools and techniques for analyzing malware and network traffic in CTF challenges, addressing various complexities such as obfuscated scripts, custom protocols, and binary analysis.

Core Features & Use Cases

  • Malware Analysis: Offers techniques for analyzing malicious software, including deobfuscation, memory forensics, and anti-analysis bypass methods.
  • Network Traffic Analysis: Provides methods for dissecting network traffic patterns, identifying C2 communications, and decrypting encrypted data.
  • Binary Analysis: Includes tools and methods for analyzing PE and .NET binaries, including static and dynamic analysis.
  • Use Case: When participating in a CTF that involves analyzing a malware sample, this Skill can help in deobfuscating scripts, identifying encryption algorithms, and extracting configuration data.

Quick Start

Use the ctf-malware skill to perform a static analysis of the provided malware executable 'malware_sample.exe'.

Frequently Asked Questions about ctf-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deobfuscate malicious scripts and extract configuration data from malware samples?▼

Malware deobfuscation involves analyzing malicious scripts and binaries to extract hidden configuration data. This Skill provides scripts and techniques to identify encryption algorithms and bypass anti-analysis methods for CTF challenges.

What's the best way to analyze PE and .NET binaries for CTF malware challenges?▼

Analyzing PE and .NET binaries requires static and dynamic analysis to identify malicious behavior. This Skill uses tools like dnSpy and pefile to perform binary triage, enabling you to dissect custom protocols and bypass anti-analysis mechanisms.

Can I use Volatility3 for memory forensics when analyzing CTF malware?▼

Volatility3 is used for memory forensics to analyze runtime malware behavior. This Skill leverages Volatility3 alongside Yara and capstone to inspect memory dumps, identify C2 communications, and extract decrypted payloads.

How do I decrypt custom network protocols and identify C2 communications in captured traffic?▼

Decrypting custom network protocols requires dissecting traffic patterns to identify C2 communications. This Skill provides network traffic analysis methods to parse captured traffic, identify encryption algorithms, and decrypt payload data.

Do I need Python libraries like yara-python and pycryptodome to perform binary triage?▼

Python libraries such as yara-python and pycryptodome are required to execute the analysis scripts provided. This Skill depends on these libraries, alongside oletools and unicorn, to automate malware deobfuscation, protocol decryption, and binary triage.

Why does my malware analysis stall when encountering anti-analysis bypass methods?▼

Malware analysis stalls when anti-analysis bypass methods prevent static inspection. This Skill addresses such constraints by providing dynamic analysis techniques using unicorn for emulation and dnSpy for .NET debugging to bypass protective layers.

Related Skills

woohyun212woohyun212
21

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

Community
Advanced
camgrimseccamgrimsec
3

oss-forensics-agent

Detect and analyze supply-chain compromise indicators in GitHub repositories.

Community
Advanced
utsavthakurutsavthakur

symbolic-execution-tools

Automate binary code analysis with angr, Z3, and Unicorn.

Community
Advanced
asdfgh1445asdfgh1445
735

ctf-malware

Reverse engineer and decrypt malware samples from CTF challenges.

Community
Advanced