Malware Analysis Guide

This skill provides analytical guidance for understanding malware samples. It does NOT execute malware — it tells you what to look for in analysis reports, sandbox results, and VirusTotal data.

Static Analysis

PE Header Analysis

• Compilation timestamp: When was it compiled? Anomalous dates suggest timestomping.
• Sections: Unusual section names (not .text/.data/.rss/.reloc) suggest packing or custom builders.
• Entropy: High entropy (>7.0) in sections suggests encryption or compression (packed).
• Imports: Key suspicious imports indicate behavior:

String Analysis

Look for:

• URLs, IP addresses, domain names (C2 infrastructure)
• File paths (drop locations, persistence targets)
• Registry keys (persistence mechanisms)
• User-Agent strings (C2 communication patterns)
• Encryption keys or encoded data
• Error messages or debug strings (developer artifacts)
• Mutex names (used to prevent multiple instances)

Packer Identification

Common packers: UPX, Themida, VMProtect, ASPack, MPRESS. Packed samples need unpacking before full static analysis. High entropy + few meaningful strings = likely packed.

Dynamic Analysis (Sandbox Interpretation)

Process Behavior

• Child processes spawned (especially cmd.exe, powershell.exe, wscript.exe)
• Process injection into legitimate processes (svchost, explorer, lsass)
• Privilege escalation attempts
• Anti-analysis checks (VM detection, sandbox detection, timing checks)

File System Activity

• Files dropped (where? what type?)
• Files modified (host files, configuration files)
• Files deleted (covering tracks, removing competitors)

Registry Activity

• Run/RunOnce keys (persistence)
• Service creation (persistence)
• Firewall rule modification (defense evasion)
• Security tool disabling

Network Activity

• DNS queries (C2 domains, DGA-generated domains)
• HTTP/HTTPS connections (C2 communication, data exfiltration)
• Raw TCP/UDP connections (custom protocol C2)
• Certificate information (self-signed = suspicious)

Analysis Output Template

## Malware Analysis: [Sample Name/Hash]

### Sample Information
- SHA-256: [hash]
- File type: [PE/ELF/document/script]
- File size: [bytes]
- First seen: [date]
- Detection ratio: [X/Y from VT]
- Family: [if identified]

### Static Analysis Findings
- Compilation: [timestamp, language, compiler]
- Packing: [packer identified or unpacked]
- Key imports: [suspicious APIs]
- Notable strings: [C2, paths, keys, mutexes]

### Dynamic Behavior
- Execution chain: [parent → child processes]
- Persistence: [mechanism and location]
- C2 communication: [protocol, destination, pattern]
- Data collection: [what data is targeted]
- Defense evasion: [anti-analysis, obfuscation]

### MITRE ATT&CK Mapping
| Tactic | Technique | Observed Behavior |
|--------|-----------|-------------------|

### IOCs Extracted
| Type | Value | Context |
|------|-------|---------|

### Assessment
[What is this malware? What does it do? Who might use it? Confidence level.]

Tooling for the sections above

When the sample is available in ReversingLabs Spectra Analyze (A1000), /lookup-reversinglabs report <hash> --detailed is the single richest source for almost everything on this page — it returns vendor-authoritative classification, TitaniumCore static analysis (headers, imports, strings, packer detection), attack (auto-mapped MITRE ATT&CK tactics + techniques from observed behaviour), rl_cloud_sandbox (dynamic analysis output), and networkthreatintelligence (C2 indicators extracted from the sample). Use it to pre-fill the MITRE ATT&CK Mapping and IOCs Extracted tables in the output template before doing your own analysis. Pivot to siblings in the same family with /lookup-reversinglabs search 'threatname:<family> classification:malicious', and to parent/child relationships with containers / extracted.

Related skills

• Sample triage before deep analysis — /hash-investigation for VT detection ratio, family attribution, behaviour tags, and pre-existing community context. If detection is high and family is known, the lookup may be sufficient.
• Vendor-authoritative analysis — /lookup-reversinglabs report <hash> --detailed for classification, MITRE ATT&CK mapping, sandbox, and network indicators in a single call. Run this whenever RL credentials are configured — it shortcuts most of the manual static + dynamic interpretation below.
• C2 and infrastructure extraction — /lookup-virustotal file <hash> --relationships contacted_ips,contacted_domains,contacted_urls,communicating_files,dropped_files,parent_files (VT) and /lookup-reversinglabs report <hash> --fields networkthreatintelligence (RL); pivot each via /indicator-pivoting
• Vendor actor attribution — /lookup-crowdstrike indicator <hash> for the threat actors and malware family CrowdStrike Falcon Intel links to the sample, plus report references; then /lookup-crowdstrike ttps <actor> to pull that actor's ATT&CK technique set into the MITRE ATT&CK Mapping table. Run whenever CrowdStrike credentials are configured.
• Community attribution — /lookup-otx file <hash> for pulses and YARA matches
• First-party correlation — /lookup-liberty91 ioc-lookup <hash> for the platform's own verdict, then library malware --name "<family>" (or --alias for a vendor's name) and entity malware <id> --section techniques|iocs|threat-events for the canonical family record: dated ATT&CK observations, associated indicators, and the occurrences the family has been named in
• Internal correlation — /lookup-misp search-attributes --value <hash> and/or /lookup-opencti lookup <hash> to surface prior catalogued intel; if the analysis produces new indicators worth keeping, /lookup-misp add-attribute / create-event and/or /lookup-opencti create-indicator
• Ransomware-family lineage — /lookup-ransomwarelive yara <group> and iocs <group> provide a curated reference set if VT family classification points to a known group
• Detection authoring — /yara-writing for family/sample rules; /sigma-writing for behavioural detection
• Apply rigor — /score-source, /apply-tlp, /confidence-language