malware-analysis
ZHMalware findings backed by reproducible evidence.
What it does
Analyzes suspected malware to produce evidence-backed findings, indicators of compromise, and detection rules.
When to use it
Use for malware sample analysis, detection-rule development, sandbox automation, indicator extraction, and anti-analysis detection or bypass.
How to use it
Give it a suspected malware sample; it returns analysis findings supported by reproducible evidence and detection rules.
What you provide
- Your files
Uses
Good to know
- acts without asking
What you need · 11
Uses rabin2 to extract strings and inspect imports; DLL and driver analysis also checks exports.
Uses floss during initial triage to extract deobfuscated strings.
Access · 4
This skill
Triage
Starts Triage analysis jobs
Submits malware samples to Triage
CAPE Sandbox
Starts CAPE Sandbox analysis jobs
Uploads samples to CAPE Sandbox