skills.rest
GhostPWN
GhostPWNOFFICIAL
Explore all skills by this author →
GitHub

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

4|Updated Mar 10, 2026
Search Tags:#static analysis#malware#sandboxing#yara#behavioral analysis#ioc extraction
One-click install
npx skills add https://github.com/GhostPWN/ghostpwn --skill malware-analysis-sandboxing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Malware Analysis & Sandboxing
Source: https://github.com/GhostPWN/ghostpwn/tree/main/src/skills/05-malware-analysis
Command: npx skills add https://github.com/GhostPWN/ghostpwn --skill malware-analysis-sandboxing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps security analysts inspect suspicious files without executing them unsafely, turning unknown binaries and scripts into actionable intelligence.

Core Features & Use Cases

  • Static analysis: Extract hashes, strings, imports, entropy, and file-type indicators from suspicious artifacts.
  • Detection engineering: Generate and refine YARA rules from samples and unique indicators.
  • Behavioral interpretation: Review sandbox outputs, map activity to MITRE ATT&CK, and classify likely malware families.
  • Use case: A malware researcher receives a suspicious executable and uses this Skill to triage it, identify host and network IOCs, and produce a detection rule for downstream hunting.

Quick Start

Use the malware analysis skill to inspect the attached suspicious sample, summarize its indicators, and generate a safe detection-oriented report.

Frequently Asked Questions about Malware Analysis & Sandboxing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely analyze malware and extract IOCs from a suspicious executable?▼

To safely analyze malware, you perform static extraction of hashes, strings, imports, and entropy from suspicious binaries to identify host and network IOCs without executing the sample outside controlled environments.

How do I generate YARA rules from malware samples for threat hunting?▼

You can generate YARA rules by extracting unique indicators and behavioral indicators from suspicious scripts and binaries, turning the extracted strings and file-type indicators into defensive detection logic for downstream hunting.

What is the best way to map sandbox reports to MITRE ATT&CK techniques?▼

Mapping sandbox reports to MITRE ATT&CK involves reviewing behavioral outputs from dynamic analysis, classifying likely malware families, and correlating the observed activity with corresponding defensive detection techniques.

Can I use static analysis to classify malware families without executing the binary?▼

Yes, static analysis allows you to classify malware families by extracting file-type indicators, imports, and strings, enabling file-safe inspection and malware triage without executing the suspicious artifacts.

What are the limitations of behavioral analysis when interpreting sandbox outputs?▼

Behavioral analysis limitations include relying on sandbox outputs for mapping activity to MITRE ATT&CK, which requires isolated security workflows to ensure samples are not executed outside controlled environments during dynamic analysis.

Related Skills

Explore More Education & Research Skills→
FuzzdkkFuzzdkk
3

malware-triage

Extract indicators from suspicious files via static malware analysis.

Community
Advanced
woohyun212woohyun212
21

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

Community
Advanced
Snausage0x45Snausage0x45
6

malware-analysis

Analyze binary executables for malicious intent via static and dynamic emulation.

Community
Advanced
YukiIto1999YukiIto1999

extracting-iocs-from-malware-samples

Extract IOCs from malware samples and export STIX 2.1 and CSV artifacts.

Community
Advanced