skills.rest
aivos-xie
aivos-xieCOMMUNITY
Explore all skills by this author →
GitHub

malware-analysis

Execute malware in a sandbox and analyze behavior with YARA rules.

1|Updated Jun 9, 2026
Search Tags:#cybersecurity#sandboxing#dynamic analysis#unpacking#YARA#malware analysis
One-click install
npx skills add https://github.com/aivos-xie/hermes-skills --skill malware-analysis-aivos-xie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/aivos-xie/hermes-skills/tree/main/security/malware-analysis
Command: npx skills add https://github.com/aivos-xie/hermes-skills --skill malware-analysis-aivos-xie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara, peframe, cuckoo, ssdeep, volatility, clamav, radare2, ghidra, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

The malware-analysis Skill provides a robust toolkit for analyzing and understanding malicious software, including sandboxing, dynamic analysis, unpacking, and YARA rule creation.

Core Features & Use Cases

  • Malware Analysis: Perform in-depth analysis of malicious software to identify its behavior, functionality, and potential impact.
  • Sandboxing: Use automated sandboxes to execute malware in a controlled environment and observe its behavior.
  • Dynamic Analysis: Monitor malware's behavior in real-time to understand its actions and interactions with the system.
  • Unpacking: Detect and remove malicious software encodings and wrappers to reveal the underlying code.
  • YARA Rule Creation: Utilize YARA to create rules for detecting and classifying malware based on specific patterns and signatures.
  • Use Case: When a new strain of malware is detected, use this Skill to analyze its behavior, extract indicators of compromise (IoCs), and develop countermeasures.

Quick Start

Analyze the malware sample 'malware.exe' using the malware-analysis skill.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze malware behavior using a sandbox environment?▼

Malware behavior analysis uses a sandbox to safely execute malicious software and monitor its real-time interactions with the system. This dynamic analysis identifies actions, functionality, and potential impact without risking your actual network.

How do I create YARA rules to detect specific malware patterns?▼

Creating YARA rules involves defining specific textual or binary patterns and signatures to classify malware families. You utilize the YARA framework to detect these patterns across files or memory, enabling precise threat hunting and incident response.

What is the best way to unpack malicious software to reveal hidden code?▼

Unpacking malicious software removes external encodings and wrappers to expose the underlying hidden code. This process is essential for understanding the true functionality of obfuscated threats during comprehensive dynamic and static analysis.

Do I need Cuckoo Sandbox and PEframe for dynamic malware analysis?▼

Yes, dynamic malware analysis relies on tools like Cuckoo Sandbox for automated execution and PEframe for static extraction. These dependencies provide the controlled environment and framework needed to observe behavior and extract indicators of compromise.

Can I extract indicators of compromise from a new malware strain?▼

Extracting indicators of compromise from a malware strain involves executing the sample in a sandbox and monitoring its dynamic behavior. This process reveals network interactions, file modifications, and specific patterns for developing targeted countermeasures.

Why does unpacking fail when analyzing highly obfuscated malware?▼

Unpacking highly obfuscated malware can fail if the wrapper employs anti-analysis techniques or complex encryption layers. Limitations arise when standard tools cannot bypass these protections, requiring advanced manual intervention to reveal the underlying code.

Related Skills

jmaglyjmagly
175

venv-manager

Create and validate Python virtual environments with dependency installation.

Community
Intermediate
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.

Official
Intermediate
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
dadbodgeoffdadbodgeoff
783

file-uploads

Implement secure file upload pipelines with ClamAV scanning and distributed locks.

Community
Advanced