malware-analysis-orchestrator

Malware triage automation works by processing PE, ELF, and Mach-O binaries through role-based execution phases to generate per-sample case directories. These directories contain ranked evidence, hypotheses, and a structured deep-analysis plan for reproducible reverse-engineering.

Structured malware analysis orchestration coordinates role-based execution to gather artifacts, generate hypotheses, and map components. It maintains evidence tracing by dumping intermediate results and maintaining status directories that expose a prioritized task queue for reproducibility.

Yes, the malware analysis orchestrator supports optional Binary Ninja or Ghidra MCP backends. These integrations enable function-level analysis to gather artifacts, generate hypotheses, and map binary components during the reverse-engineering workflow.

Yes, you can analyze both Windows PE and Linux ELF malware samples, as well as Mach-O binaries. The orchestrator applies phase-driven artifact generation across all three executable formats to produce structured triage reports and analysis plans.

To start end-to-end malware triage orchestration, run the orchestrator on a target sample. Inspect the generated status/ directory to review intermediate outputs, ranked evidence, and the prioritized task queue that outlines your next deep-analysis steps.

Automated malware analysis orchestration focuses on structured triage, evidence gathering, and generating deep-analysis plans rather than fully automated remediation. It requires optional Binary Ninja or Ghidra MCP backends for function-level analysis and is limited to PE, ELF, and Mach-O binary formats.