Malware Analysis

This is your comprehensive toolkit for analyzing suspicious binaries and scripts, from initial triage with pestudio and capa to writing production YARA rules. It walks through both static analysis (strings extraction, import enumeration, entropy checks) and dynamic behavior profiling in sandboxes with process monitoring and network capture. The anti-analysis detection section is especially practical, covering the real evasion techniques you'll encounter like sleep delays, VM checks, and timing attacks. If you're doing incident response or threat intelligence work, the C2 protocol analysis and fileless malware sections alone justify having this loaded. The unpacking guidance covers both automated tools and manual OEP dumping when dealing with custom packers.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill malware-analysis --agent claude-code

Installs into .claude/skills of the current project.

Files

Malware Analysis

When to Activate

Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).
Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).
Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.
Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).
Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.