Malware Analysis

Analyze Windows PE binaries to extract IOCs and map them to MITRE ATT&CK.

Updated Aug 6, 2026

Search Tags:#reverse engineering #MITRE ATT&CK #malware analysis #IOC extraction #PE binary

Ready to run

npx skills add https://github.com/alicangnll/Spectra --skill malware-analysis-alicangnll

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Malware Analysis
Source: https://github.com/alicangnll/Spectra/tree/main/spectra/skills/builtins/malware-analysis
Command: npx skills add https://github.com/alicangnll/Spectra --skill malware-analysis-alicangnll

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the analysis of Windows PE malware binaries, extracting indicators of compromise (IOCs) and mapping them to the MITRE ATT&CK framework.

Core Features & Use Cases

Automated Analysis: Analyze PE binaries for obfuscation, reconnaissance, execution flow, targeted analysis, persistence, evasion, and reporting.
IOC Extraction: Identify and extract IOCs such as URLs, API paths, user agents, mutex names, file extensions, registry paths, and app paths.
MITRE ATT&CK Mapping: Map IOCs to the MITRE ATT&CK framework for a comprehensive understanding of the malware's capabilities.
Use Case: Quickly analyze a suspicious binary to determine its malicious intent and potential impact on the system.

Quick Start

Analyze the PE binary 'malware.exe' for IOCs and generate a report.

Frequently Asked Questions about Malware Analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract IOCs from a Windows PE binary?▼

You can extract IOCs from a Windows PE binary by automating the analysis of obfuscation, execution flow, and persistence mechanisms to identify URLs, API paths, mutex names, and registry paths.

Can I map malware behavior to the MITRE ATT&CK framework automatically?▼

Yes, you can map extracted IOCs and execution behaviors directly to the MITRE ATT&CK framework automatically to comprehensively understand the malware's capabilities and potential system impact.

What Windows PE malware analysis tasks can be automated?▼

Automated Windows PE malware analysis covers obfuscation triage, reconnaissance, execution flow analysis, persistence and evasion checking, and report generation to determine malicious intent.

Do I need specific analysis tools to parse PE binary streams?▼

Yes, you need specific analysis tools and libraries to parse PE binary streams and extract relevant information for obfuscation triage, execution flow analysis, and targeted analysis.

What types of indicators of compromise can be identified in PE binaries?▼

You can identify indicators of compromise such as URLs, API paths, user agents, mutex names, file extensions, registry paths, and app paths within the PE binaries during targeted analysis.