skills.rest
alicangnll
alicangnllCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

Malware Analysis

Analyze Windows PE binaries to extract IOCs and map them to MITRE ATT&CK.

Updated Aug 6, 2026
Search Tags:#reverse engineering#MITRE ATT&CK#malware analysis#IOC extraction#PE binary
One-click install
npx skills add https://github.com/alicangnll/Spectra --skill malware-analysis-alicangnll
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Malware Analysis
Source: https://github.com/alicangnll/Spectra/tree/main/spectra/skills/builtins/malware-analysis
Command: npx skills add https://github.com/alicangnll/Spectra --skill malware-analysis-alicangnll

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the analysis of Windows PE malware binaries, extracting indicators of compromise (IOCs) and mapping them to the MITRE ATT&CK framework.

Core Features & Use Cases

  • Automated Analysis: Analyze PE binaries for obfuscation, reconnaissance, execution flow, targeted analysis, persistence, evasion, and reporting.
  • IOC Extraction: Identify and extract IOCs such as URLs, API paths, user agents, mutex names, file extensions, registry paths, and app paths.
  • MITRE ATT&CK Mapping: Map IOCs to the MITRE ATT&CK framework for a comprehensive understanding of the malware's capabilities.
  • Use Case: Quickly analyze a suspicious binary to determine its malicious intent and potential impact on the system.

Quick Start

Analyze the PE binary 'malware.exe' for IOCs and generate a report.

Frequently Asked Questions about Malware Analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract IOCs from a Windows PE binary?▼

You can extract IOCs from a Windows PE binary by automating the analysis of obfuscation, execution flow, and persistence mechanisms to identify URLs, API paths, mutex names, and registry paths.

Can I map malware behavior to the MITRE ATT&CK framework automatically?▼

Yes, you can map extracted IOCs and execution behaviors directly to the MITRE ATT&CK framework automatically to comprehensively understand the malware's capabilities and potential system impact.

What Windows PE malware analysis tasks can be automated?▼

Automated Windows PE malware analysis covers obfuscation triage, reconnaissance, execution flow analysis, persistence and evasion checking, and report generation to determine malicious intent.

Do I need specific analysis tools to parse PE binary streams?▼

Yes, you need specific analysis tools and libraries to parse PE binary streams and extract relevant information for obfuscation triage, execution flow analysis, and targeted analysis.

What types of indicators of compromise can be identified in PE binaries?▼

You can identify indicators of compromise such as URLs, API paths, user agents, mutex names, file extensions, registry paths, and app paths within the PE binaries during targeted analysis.

Related Skills

Explore More Software Engineering Skills→
alicangnllalicangnll

VM/Obfuscation Detection

Detect VMProtect, Themida, UPX, and control flow flattening in binaries.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
YukiIto1999YukiIto1999

reverse-engineering-malware-with-ghidra

Reverse-engineer Windows malware binaries with Ghidra to map C2 protocols and evasion techniques.

Community
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced