skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

malware-analysis-methodology

Analyze suspicious PE, ELF, and Mach-O binaries through static, dynamic, and IOC extraction workflows.

1.7k|238|Updated Dec 7, 2019
Search Tags:#static analysis#reverse engineering#dynamic analysis#pe#elf#malware analysis#IOC extraction
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill malware-analysis-methodology
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-analysis-methodology
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/malware/malware-analysis-methodology
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill malware-analysis-methodology

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pefile, pyelftools, and includes references (resource) components.

What problem does it solve?

Analyzing suspicious binaries and memory dumps requires a structured process across static inspection, dynamic execution, and IOC extraction, and doing it ad hoc risks missing indicators or executing samples unsafely.

Core Features & Use Cases

  • Static Analysis: Inspect PE headers, imports, section entropy, imphash, and ELF symbols using pefile, pyelftools, readelf, and Detect It Easy to identify packing, injection APIs, and anti-debugging behavior.
  • Dynamic Analysis: Run samples in isolated VMs, Docker, or sandboxes (AnyRun, CAPE, Cuckoo) with Procmon, strace, FakeNet-NG, and API Monitor to observe file, registry, process, and network behavior.
  • IOC Extraction & TTP Mapping: Produce a complete indicator checklist covering hashes, network indicators, file system artifacts, persistence mechanisms, and MITRE ATT&CK technique mapping.
  • Use Case: Given an unknown ELF binary found on a compromised Linux server, follow the phased workflow to compute hashes, detect high-entropy packed sections, trace syscalls in an isolated container, and extract C2 addresses and persistence artifacts.

Quick Start

Analyze the suspicious binary sample.exe using the malware analysis methodology and produce a full IOC report with MITRE ATT&CK mapping.

Frequently Asked Questions about malware-analysis-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I statically analyze a suspicious PE file?▼

Static PE analysis starts with computing MD5 and SHA256 hashes, then inspecting headers, sections, and imports with pefile or pestudio. High section entropy above 7.0, entry points outside .text, and imports like VirtualAlloc or CreateRemoteThread indicate packing or injection behavior.

How to detect if a malware sample is packed?▼

Detect packing by checking section names like .UPX0 or .themida, measuring section entropy above 7.0, and comparing RawSize versus VirtualSize. Tools like Detect It Easy and upx -t identify known packers, while entry points outside .text suggest runtime unpacking.

What tools are used for dynamic malware analysis?▼

Dynamic analysis uses sandboxes like AnyRun, CAPE, and Cuckoo, plus local tools such as Procmon for file and registry operations, strace and ltrace on Linux, FakeNet-NG for network simulation, and API Monitor for tracing injection and persistence API calls.

Can I safely run malware samples in Docker?▼

Docker can isolate Linux samples when run with --network=none, --cap-drop=ALL, and no-new-privileges, but it is not a hard security boundary. A dedicated VM or sandbox is safer, and samples should never execute on non-isolated production systems.

What IOCs should be extracted from a malware sample?▼

A complete IOC set includes MD5 and SHA256 hashes, network indicators like IPs, domains, and URI paths, created or modified file paths, registry keys, process names and command lines, persistence mechanisms, and a mapping to MITRE ATT&CK techniques.

Why does malware fail to run inside a sandbox?▼

Many samples detect sandbox artifacts such as Cuckoo's agent processes, hook DLLs, or specific file paths and exit immediately. Others use long sleep timers to exceed analysis windows or require user interaction like realistic mouse movement before executing payloads.

Related Skills

Explore More Software Engineering Skills→
msandbumsandbu
2

honeypot-investigation

Automates security analysis of honeypot servers by querying failed connections and enriching IPs with threat intelligence.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
SherifEldeebSherifEldeeb
5

memory-forensics

Analyze volatile memory dumps for malware and rootkits using Volatility 3.

Community
Advanced
aivos-xieaivos-xie
1

ai-reverse-engineering

Automate binary code decompilation and analysis with IDA Pro and Ghidra.

Community
Advanced