skills.rest
Liberty91LTD
Liberty91LTDOFFICIAL
Explore all skills by this author →
Website𝕏@liberty__91GitHub

malware-analysis

Identify malware samples and extract static and dynamic indicators from reports.

15|5|Updated Apr 6, 2026
Search Tags:#analysis#static-analysis#sandbox#malware#indicators#dynamic-analysis#mitre-attack
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill malware-analysis-liberty91ltd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill malware-analysis-liberty91ltd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Malware analysis teams need a consistent framework to evaluate and report on suspicious software, reducing guesswork and errors.

Core Features & Use Cases

  • Static Analysis guidance: PE header, imports, strings, packing indicators.
  • Dynamic Analysis guidance: sandbox behavior, process activity, network indicators.
  • Reporting templates: structured output with MITRE ATT&CK mapping and IOCs.

Quick Start

Follow the guided steps to review a malware sample, document static and dynamic indicators, and produce a structured report.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract static and dynamic indicators from a malware sample?▼

To extract malware indicators, follow a structured workflow that documents PE headers, imports, strings, and packing for static analysis, alongside sandbox behavior and network activity for dynamic analysis.

What is the best way to map malware sandbox behavior to MITRE ATT&CK techniques?▼

Mapping malware sandbox behavior to MITRE ATT&CK involves documenting observed process activity and network indicators within a dynamic analysis section, then correlating those behaviors directly to specific ATT&CK tactics and techniques.

How do I generate a structured incident response report for malware analysis?▼

Malware analysis report generation uses a reproducible workflow template that consolidates static indicators, dynamic sandbox behaviors, string extraction, and MITRE ATT&CK mappings into a structured output for incident response.

What static analysis checks should I perform to identify malware packing indicators?▼

Identifying malware packing indicators requires static analysis of the PE header, reviewing imported functions, and examining extracted strings to detect anomalies or obfuscation typical of packed executables.

Can I use this malware analysis workflow for both static and dynamic evaluation?▼

Yes, this malware analysis workflow applies to both static and dynamic evaluation, providing guided steps for reviewing PE headers and strings as well as observing sandbox behavior and network activity.

Related Skills

Explore More Education & Research Skills→
GhostPWNGhostPWN
4

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

Official
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-summarization

Generate executive and technical security incident reports with MITRE ATT&CK mappings.

Official
Intermediate
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
dreadnodedreadnode
11

spectra-assure

Detect tampering and malware in software packages via behavioral differential analysis.

Official
Advanced