skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Skill: Malware Analysis (Static / Capability)

Extract static evidence and map malware capabilities to ATT&CK techniques.

1|Updated Apr 25, 2026
Search Tags:#malware analysis#ioc extraction#att&ck mapping#static triage#capability profiling#yara hunting#entropy detection
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill skill-malware-analysis-static-capability
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Skill: Malware Analysis (Static / Capability)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill skill-malware-analysis-static-capability

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires file, exiftool, md5sum, sha256sum, ssdeep, strings, capa, binwalk, upx, objdump, readelf, yara, hexdump, xxd, grep, awk, python3.

What problem does it solve?

It reduces analyst uncertainty by turning raw, suspicious binaries/scripts/dumps into a structured capability profile that answers what the artifact does and how it behaves.

Core Features & Use Cases

  • Static identification & hashing: Extract file type, metadata, and multiple hashes for IOC logging and similarity matching.
  • Packing/entropy & unpacking loop: Detect likely packing/obfuscation (e.g., UPX) and re-run analysis on unpacked payloads.
  • Capability discovery with ATT&CK mapping: Use capa plus import-category heuristics to build an operational capability summary and pivot to next steps.

Quick Start

Use this skill to analyze the suspicious file 'sample.bin' end-to-end, producing file type, hashes, strings-derived IOCs, packing status, and an ATT&CK-oriented capability profile.

Frequently Asked Questions about Skill: Malware Analysis (Static / Capability)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform static malware analysis on a suspicious executable file?▼

Static malware analysis identifies file types, extracts metadata and hashes, checks entropy and packing status, and maps capabilities to ATT&CK techniques to profile suspicious executable behavior.

How do I extract IOCs and derive a capability profile from an unknown binary?▼

IOC extraction and capability profiling derive hashes, strings, and import heuristics from unknown binaries using capa to produce an ATT&CK-oriented output for escalation and pivoting.

What is the best way to detect packing or obfuscation in a suspicious file?▼

Detecting packing or obfuscation involves calculating file entropy and identifying packers like UPX, optionally unpacking payloads to re-run static analysis on the original binary.

Can I use capa and yara to map malware capabilities to MITRE ATT&CK techniques?▼

Capa and yara map malware capabilities to MITRE ATT&CK techniques by matching static code features and string signatures against known adversary tactics, techniques, and procedures.

Does static triage require unpacking UPX-packed binaries before running strings?▼

Static triage detects UPX packing via entropy checks and unpacks binaries before running strings and capa, ensuring capability extraction targets unpacked payloads rather than obfuscated wrappers.

What tools are needed for DFIR triage and static capability profiling of scripts?▼

DFIR triage and capability profiling of scripts require file, exiftool, md5sum, sha256sum, strings, capa, binwalk, and yara to extract metadata, hashes, and static evidence.

Related Skills

Explore More Education & Research Skills→
FuzzdkkFuzzdkk
3

malware-triage

Extract indicators from suspicious files via static malware analysis.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
majesticlabs-devmajesticlabs-dev
47

ruby-coder

Guide Ruby 3.x code writing with Sandi Metz's rules and composition.

Official
Advanced
gmh5225gmh5225
868

dynamic-instrumentation

Instrument LLVM-based binaries at runtime to observe and analyze behavior.

Community
Advanced