skills.rest
Fuzzdkk
FuzzdkkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

malware-triage

Extract indicators from suspicious files via static malware analysis.

3|Updated Apr 10, 2026
Search Tags:#metadata#static-analysis#triage#malware#binary-analysis#hashes#yara
One-click install
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill malware-triage-fuzzdkk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: malware-triage
Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/malware-triage
Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill malware-triage-fuzzdkk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static malware analysis of suspicious files to extract indicators without execution, reducing risk and time spent on manual triage.

Core Features & Use Cases

  • Metadata extraction (exiftool, file, hashes)
  • Strings and content discovery (strings, binwalk)
  • Binary structure analysis (readelf, objdump, radare2)
  • Indicator generation (hashes, URLs, IPs, domains)
  • Threat reporting and optional YARA scanning

Quick Start

Provide the path to the suspicious file as the target to begin static triage.

Frequently Asked Questions about malware-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform static malware analysis on a suspicious file without executing it?▼

Static malware analysis extracts indicators without executing the file by using tools like strings, exiftool, and radare2 to gather metadata, hashes, and binary structure information for safe triage.

What is the best way to extract URLs, IPs, and domains from suspicious binaries during incident response?▼

Extracting URLs, IPs, and domains from suspicious binaries is done through static triage using strings discovery and binary structure analysis to generate actionable indicators for security investigations.

Can I analyze both Windows and Linux binaries for malware triage?▼

Yes, malware triage supports both Windows and Linux binaries, applying static analysis techniques across various file formats encountered in incident response and security investigations.

How do I extract metadata and strings from a suspicious file for threat reporting?▼

Extracting metadata and strings from a suspicious file requires tools such as exiftool, file, strings, and binwalk to discover embedded content and generate hashes for threat reporting.

Does static malware triage include YARA scanning for binary analysis?▼

Static malware triage includes optional YARA scanning alongside binary structure analysis using readelf, objdump, and radare2 to identify patterns and collect indicators during security investigations.

What are the limitations of static analysis for malware triage?▼

Static analysis for malware triage is limited to extracting metadata, strings, and binary structures without execution, meaning it cannot observe dynamic runtime behaviors or unpack obfuscated payloads requiring active detonation.

Related Skills

Explore More Data & Analytics Skills→
FuzzdkkFuzzdkk
3

reverse-engineering

Analyze PE, ELF, shellcode, and documents with radare2, objdump, and readelf.

Community
Intermediate
woohyun212woohyun212
21

ioc-extract

Extract IPs, domains, URLs, emails, and file hashes from text, logs, or URLs.

Community
Intermediate
DexterJieDexterJie

ctf-malware

Analyze malware and network traffic in CTF challenges.

Community
Advanced
YukiIto1999YukiIto1999

reverse-engineering-android-malware-with-jadx

Decompile Android APKs with JADX to identify malicious behaviors.

Community
Advanced