malware-analysis-static

name malware-analysis-static author Gianni Amato version 1.3.0 homepage https://github.com/guelfoweb/malware-analysis-static description Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution. Malware Analysis Static Before starting, show this warning: Warning: malware analysis should be performed only on an isolated lab machine or disposable VM, never on a personal or production workstation. Startup Create or reuse a case directory. Create or read AGENTS.md and REPORT.md . Preserve the original sample before substantive analysis. Scope Static analysis and reverse engineering for: Windows PE, DLL, driver, and .NET assemblies Linux ELF and macOS Mach-O binaries Android APKs and embedded native libraries Office/OLE/OOXML/RTF documents, VBA, VBS, JS, HTA, WSF, PowerShell HTML, HTM, MHTML, SVG, XML, XSL, webshells, and source-code droppers scripts in BAT, CMD, shell, Python, PHP, Perl, Ruby, Lua, AutoIt, Node.js, JSP, ASP, ASPX, and similar formats extracted, embedded, decoded, dropped, downloaded, or chained stages Do not execute malware unless the user explicitly authorizes dynamic analysis in an isolated disposable lab. Load The Right Playbook Keep this file loaded as the core workflow. Load only the playbook needed for the current sample or stage: Android APK: references/apk.md Windows PE, DLL, driver, .NET: references/pe-dotnet.md Office, VBA, VBS, JS, HTA, WSF, PowerShell, script droppers: references/office-script.md HTML, web payloads, source-code droppers, webshells: references/web-payload.md ELF, Mach-O, Unix shell payloads: references/unix-binary.md For every new embedded, decoded, extracted, dropped, or downloaded stage, repeat type identification and load the matching playbook for that stage. Do not load unrelated playbooks unless the sample actually crosses formats. Analyst Objectives For every sample and stage, determine when possible: file type, architecture, language, container, packer, and protection MD5, SHA1, SHA256 parent-child stage relationship and execution or compromise chain order C2 URLs, domains, IPs, Telegram/API endpoints, panels, and fallback infrastructure drop URLs, stage URLs, update URLs, config URLs, and retrieval logic persistence, anti-analysis, privilege, lateral movement, and exfiltration behavior config, keys, campaign IDs, mutexes, service/task/receiver names, user agents decoding, decryption, decompression, unpacking, request-building, and staging algorithms likely family, cluster, loader, toolkit, or unknown with confidence and evidence Make supported claims only. State uncertainty and static-analysis limits explicitly. Autonomy And Reverse Engineering Discipline Do real reverse engineering, not IOC grepping. Continue automatically through the next reasonable analytical step within authorized scope. Do not ask whether to parse the next stream, resource, object, blob, macro, xref, class, section, overlay, function, or extracted file. Do not ask the user to choose between equivalent next steps; attempt the best one and document the result. If remote retrieval is not authorized, continue with offline extraction, carving, decoding, deobfuscation, xrefs, disassembly, decompilation, and decoder reconstruction. Do not stop at the first obstacle. Try fallback tools, lower-level views, alternate extraction, and manual reconstruction before declaring a blocker. Ask only when a missing tool must be installed, network retrieval or execution exceeds prior authorization, a real safety/cost decision exists, or an external dependency blocks progress. Valid escalation path examples: strings -> decoded strings -> offsets -> xrefs -> disassembly -> decompilation manifest -> jadx source -> smali -> native libraries -> config decoder macro/script -> deobfuscation -> command reconstruction -> stage extraction PE metadata -> imports/resources -> config carving -> FLOSS/xorsearch -> Ghidra/radare2 Token Budget And Anti-Loop Mode These rules are mandatory: Keep chat minimal: status, key findings, evidence paths, next action. Never paste raw strings, logs, decompiler output, decoded blobs, candidate lists, or large command output in chat. Save verbose output under case/ and inspect it with bounded commands such as rg , head , tail , wc , and sort -u . Save reusable helper code under case/04-decoding/ ; do not rewrite long inline scripts repeatedly. After two failed attempts on the same branch, document the blocker and pivot unless a new hypothesis exists. Do not claim success unless the artifact exists, has a type, and has MD5/SHA1/SHA256 recorded. Update AGENTS.md and REPORT.md ; do not use chat as working memory. Tool Discovery And Installation This skill must work without bundled scripts. Discover tools dynamically and use equivalents across Linux, macOS, and Windows. Before deep analysis: Detect OS and shell. Identify sample type. Check only the tools relevant to that type and its current stage. Use available fallbacks when adequate. Ask the user before each missing tool installation. Never install silently. After authorization, use the native package manager or official installation path. Record installed, missing, fallback, and degraded capabilities in AGENTS.md . Discovery examples: uname -s command -v file strings rg python3 node php perl bash sh pwsh yara objdump llvm-objdump readelf nm otool lipo r2 rabin2 jadx apktool aapt2 floss xorsearch ilspycmd monodis oleid olevba oledump.py exiftool binwalk 7z upx analyzeHeadless xmllint xxd base64 iconv python3 -c "import pefile, lief" 2>/dev/null $PSVersionTable.PSVersion Get-Command file,strings,rg,python,py,node,php,perl,pwsh,yara,objdump,llvm-objdump,dumpbin,r2,rabin2,jadx,apktool,aapt2,floss,xorsearch,ilspycmd,monodis,oleid,olevba,oledump.py,exiftool,7z,analyzeHeadless,xmllint -ErrorAction SilentlyContinue py -c "import pefile, lief" 2>$null Core tools expected in most cases: file , hash tooling, strings , rg , python3 or py , 7z , exiftool , yara , xxd , base64 . Reverse-engineering tools expected when relevant: objdump , llvm-objdump , readelf , nm , otool , lipo , radare2 / r2 , rabin2 , Ghidra headless analyzeHeadless , binwalk . Format-specific tools: jadx , apktool , aapt2 , bundletool , apkanalyzer , floss , xorsearch , ilspycmd , monodis , Python pefile and lief , oletools ( oleid , olevba ), oledump.py , rtfobj , unzip , zipinfo , xmllint , iconv , node , php , perl , pwsh , CyberChef CLI, beautifiers, AST parsers, capa , upx , sigcheck . Install missing tools only after explicit user authorization. Prefer native package managers: Linux apt , dnf , pacman ; macOS brew ; Windows winget or choco ; plus pipx / pip and dotnet tool where appropriate. Use official sources for Ghidra, jadx, apktool, radare2, YARA, Java, .NET SDK, and Python tools. Record installations in AGENTS.md . Case Layout Create a case directory and preserve the original sample. Recommended layout: case/ AGENTS.md REPORT.md 00-intake/ 01-triage/ 02-strings/ 03-static/ 04-decoding/ 05-config/ 06-extracted/ 07-stages/ 08-yara/ 09-reports/ 10-iocs/ 11-notes/ Save command output to files when practical. Never overwrite the original sample or extracted evidence; create versioned names when needed. AGENTS.md Memory Create or read AGENTS.md before substantive work. Update it after every meaningful action. Required sections: Current Summary Sample Inventory Environment And Tooling Timeline Stage Graph Confirmed Findings Decoders And Algorithms Family Attribution Evidence Index Open Questions Next Actions Final Assessment Use AGENTS.md as persistent working memory for context, decisions, failed attempts, fallback tools, extracted stages, provenance, decoder notes, and unresolved blockers. REPORT.md Requirements Create REPORT.md during the analysis and update the same file if work continues. Keep it clear, simple, and readable. Required content: case summary sample inventory with MD5, SHA1, SHA256, file type, size, and role ordered execution or compromise chain stage table with filename/label, parent, source URL or extraction path, hashes, file type, and role indicators separated as drop URLs, stage URLs, C2 URLs, domains, IP addresses, Telegram/API artifacts, panels, and fallback infrastructure decoding, decryption, unpacking, request-building, and staging logic persistence, anti-analysis, privilege, and exfiltration findings family or cluster assessment with evidence and confidence limitations and where the chain breaks, if incomplete REPORT.md is the analyst-facing report. AGENTS.md is the working memory. Multi-Stage Handling Treat every extracted, embedded, decoded, dropped, or downloaded component as a stage until proven irrelevant. For each stage: Assign a stable stage ID. Record parent sample, origin offset/path/URL/code path, extraction or retrieval method. Save the raw artifact under case/07-stages/ or a clearly named evidence path. Compute MD5, SHA1, SHA256 immediately. Re-identify type and load the matching playbook. Continue analysis recursively within scope. Update AGENTS.md , REPORT.md , and the stage graph. When a confirmed drop URL, stage URL, payload URL, config URL, update URL, or fallback URL is found and retrieval is already authorized in a lab context: retrieve it without asking again save, hash, document, and analyze it as a new stage preserve the parent request logic: URL construction, parameters, headers, method, cookies, keys, offsets, wrappers, encodings, archives, rename rules, and post-download transforms if the parent code decodes, decrypts, decompresses, patches, or wraps the payload before use, reproduce and document that logic before concluding When retrieval is not authorized: do not ask whether to retrieve as the next step continue automatically with offline parsing, carving, deobfuscation, decoder reconstruction, embedded blob extraction, and deeper reverse engineering document remote retrieval as a next option only after the reasonable offline path is exhausted Required Workflow Show the lab warning. Create/reuse the case directory, AGENTS.md , and REPORT.md . Preserve the original sample and compute MD5, SHA1, SHA256. Identify file type, architecture, language, container, and likely stage role. Check relevant tools and ask before installing missing blocking tools. Run triage: metadata, strings, Unicode strings, archive/container inspection, YARA where useful. Load the matching playbook and perform deeper static analysis. Reconstruct decoders, configs, command lines, request builders, and staging logic. Extract and analyze embedded or downloaded stages using the multi-stage rules. Attempt family attribution using defensible evidence. Update AGENTS.md and REPORT.md . Final response: concise findings, hashes, family candidates, C2/drop/stage URLs, evidence paths, report paths, confidence, and limits. Family Attribution Try to identify the family, cluster, loader, toolkit, or campaign only when supported by evidence such as config layout, protocol, crypto constants, mutexes, service names, task names, receiver names, user-agent format, registry/filesystem conventions, builder markers, packer signatures, distinctive code, infrastructure, or stage relationships. If attribution is weak, report candidate families or unknown , explain why, and lower confidence. For APKs, use the Android family-pattern dataset described in references/apk.md as supporting evidence only, never as proof by itself. Final Answer Use concise structured output. Include: sample and stage count SHA256 of the primary sample likely family or candidate families key behavior and execution chain C2, drop URLs, stage URLs, domains, and IPs with origin decoding/decryption/staging logic persistence and anti-analysis extracted stages and hashes evidence locations AGENTS.md and REPORT.md status confidence and limitations Safety Rules Never run malware on a personal or production machine. Never execute samples, scripts, macros, HTML smuggling chains, or webshells unless explicitly authorized in an isolated lab. Never claim a URL is active, reachable, or malicious without evidence. Never destroy or overwrite original evidence. Keep decoder scripts minimal, deterministic, and operating on inert data. Keep dynamic observations separate from static findings.