skills.rest
ImJoke
ImJokeCOMMUNITY
Explore all skills by this author →
GitHub

Malware Analysis & Reverse Engineering

Analyze PE, ELF, and script-based malware across four-phase triage, static, dynamic, and unpacking workflows.

1|Updated Apr 25, 2026
Search Tags:#research#analysis#static-analysis#malware#forensics#reverse-engineering#dynamic-analysis
One-click install
npx skills add https://github.com/ImJoke/dsec --skill malware-analysis-reverse-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Malware Analysis & Reverse Engineering
Source: https://github.com/ImJoke/dsec/tree/main/dsec/skills/bundled/malware-analysis
Command: npx skills add https://github.com/ImJoke/dsec --skill malware-analysis-reverse-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analysts lack a repeatable, phased methodology to triage, statically analyze, and dynamically analyze PE, ELF, and script-based malware, ensuring consistent artefact extraction and reporting.

Core Features & Use Cases

  • Triage and file identification with packing detection and VT checks
  • Static analysis workflow using tools like Ghidra, IDA Free, strings, and entropy analysis
  • Dynamic analysis workflow using sandboxing and monitoring (ANY.RUN, Cuckoo, ProcMon)
  • Unpacking and deobfuscation guidance for common packers and obfuscation techniques
  • Research-grade workflow suitable for incident response, threat hunting, and malware research

Quick Start

Start by selecting a malware sample and walking through triage, static analysis, dynamic analysis, and unpacking.

Frequently Asked Questions about Malware Analysis & Reverse Engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the best way to perform malware triage and static analysis on PE and ELF samples?▼

Malware triage and static analysis on PE and ELF samples involves identifying file behaviors using packing detection, entropy analysis, and tools like Ghidra or IDA Free to extract indicators without executing the code.

How do I unpack malware and deobfuscate common packers during reverse engineering?▼

Unpacking malware requires dynamic analysis using sandbox environments like ANY.RUN or Cuckoo to trace execution. Reverse engineering then identifies the original entry point to dump unpacked code for static review.

Can I use this workflow for incident response and threat hunting across enterprise networks?▼

Yes, this malware analysis workflow applies directly to incident response and threat hunting across enterprise networks. It extracts structured artifacts from script-based samples to support enterprise threat research.

What tools do I need for dynamic malware analysis and behavioral monitoring?▼

Dynamic malware analysis and behavioral monitoring require sandboxing and monitoring tools like ANY.RUN, Cuckoo, and ProcMon. These tools trace system interactions to identify runtime behaviors and indicators.

When should I use static analysis instead of dynamic analysis for malware forensics?▼

Static analysis is used first for malware forensics to gather strings and entropy data safely. Dynamic analysis follows when you need to observe runtime behaviors, especially for unpacking and deobfuscation.

Related Skills

Explore More Education & Research Skills→
salmanabdurrahmansalmanabdurrahman

malware-triage

Perform static analysis on PE, ELF, Mach-O, and script samples to generate indicators of compromise.

Community
Advanced
workromancerworkromancer

web-load2

Fetch web URLs and extract all text content.

Community
Basic
letta-ailetta-ai
134

path-tracing-reverse

Reverse engineer ray-tracing binaries to reconstruct pixel-perfect rendering algorithms.

Official
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced