Malware Analysis Workflow
Guides an agent through static, sandbox and rule-based analysis of suspected malware samples
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 4 files
What it does
When installed, the agent follows a structured six-phase malware analysis process: triage with file and string tools, PE header and import review, sandbox-based dynamic analysis, writing YARA and Sigma detection rules, and extracting indicators of compromise (IOCs) such as domains, file paths and mutexes. It also covers anti-analysis techniques like debugger and VM detection and how to record evidence. The instructions are written mostly in Chinese and assume a reverse engineer's toolkit.
Great for
- Security analysts and reverse engineers working on suspected malware in an isolated lab
- Students learning how static and dynamic malware analysis fit together
- Threat intel teams drafting YARA or Sigma rules from a sample
Skip it if
- Running unknown samples on a personal or production machine, since the workflow includes unpacking and debugger work that can execute malicious code
- Users without a sandbox or isolated VM, because the skill does not provide one and the risk falls on the user
- Anyone expecting a turnkey scanner; it guides analysis steps and depends on external tools the user must install
Try asking
- “Analyze this suspicious PE file in my isolated VM and summarize its imports and likely capabilities”
- “Write a YARA rule that detects this sample's embedded C2 URL pattern”
- “Turn the process injection behaviour I observed into a Sigma rule with false positive notes”
- “Extract IOCs from this PowerShell dropper and list the domains, mutexes and registry keys”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the MIT licence and an attribution note.
malware-analysis.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip malware-analysis.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip malware-analysis.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run every sample only inside an isolated, snapshotted analysis VM with networking restricted or simulated.
- Verify the referenced files and tool paths exist before relying on the workflow, since the skill tells the agent to read files outside its own folder.
- Treat the skill's instructions to skip confirmation and proceed as ACTION-REQUIRED directives; review each step before the agent executes commands.
What's inside
- references/anti-analysis-techniques.md
- references/sandbox-orchestration.md
- references/yara-sigma-rules.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.