malware-analysis

Analyze binary executables for malicious intent via static and dynamic emulation.

6|Updated Jul 22, 2026

Search Tags:#security #analysis #triage #malware #emulation #reverse-engineering

Ready to run

npx skills add https://github.com/Snausage0x45/ClaudeSkills --skill malware-analysis-snausage0x45

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/Snausage0x45/ClaudeSkills/tree/main/malware-analysis
Command: npx skills add https://github.com/Snausage0x45/ClaudeSkills --skill malware-analysis-snausage0x45

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pefile, capstone, yara-python, signify, sogen, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill provides a safe, contained environment to analyze suspicious binaries, allowing you to determine if a file is malicious without risking your host system.

Core Features & Use Cases

Static Triage: Automatically hashes, parses PE headers, extracts strings, and identifies packer heuristics.
Dynamic Emulation: Uses the sogen emulator to safely detonate samples, resolve dynamic imports, and recover encrypted strings.
Reporting: Generates a comprehensive, Google-style technical report mapping findings to MITRE ATT&CK techniques.

Quick Start

Use the malware-analysis skill to analyze the suspicious binary located at /tmp/sample.exe and generate a report in the current directory.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I safely analyze a suspicious binary executable for malicious intent?▼

To safely analyze a suspicious binary executable, this skill performs static and dynamic analysis within an isolated emulation environment. It detonates the sample using the sogen emulator to trace behavior and map findings to MITRE ATT&CK techniques.

How do I extract strings and identify packer heuristics from a Windows executable?▼

Static triage automatically parses PE headers, extracts strings, and identifies packer heuristics from Windows executables. This process hashes the file and determines structural anomalies before any dynamic execution occurs.

Do I need uv and a Windows emulation root to detonate malware samples?▼

Yes, you need uv for dependency management and a valid Windows emulation root to execute dynamic behavioral analysis. These components are required to safely detonate samples and resolve dynamic imports.

Can dynamic emulation resolve encrypted strings and dynamic imports in packed binaries?▼

Dynamic emulation resolves encrypted strings and dynamic imports by safely detonating packed binaries in an isolated environment. This process uses the sogen emulator to recover hidden operational capabilities during execution.

What is the best way to generate a technical report mapping malware findings to MITRE ATT&CK techniques?▼

The best way to generate a technical report mapping malware findings to MITRE ATT&CK techniques is through comprehensive static and dynamic analysis. The skill outputs a Google-style technical report detailing operational capabilities.

Why does dynamic analysis require an isolated emulation environment for reverse engineering?▼

Dynamic analysis requires an isolated emulation environment to safely detonate suspicious binaries without risking the host system. This containment allows behavioral tracing and multi-stage unpacking while preventing infection.