Claude Skills by meltedinhex

'Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable

'Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by

'Analyzes Windows Authenticode signatures on PE files: checking for a signature,

'Analyzes banking trojan webinject configurations to extract targeted institutions,

'Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting

'Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints

'Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common

'Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols

'Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet

'Analyzes Go-compiled malware by recovering function names from the pclntab, detecting

'Analyzes infostealer samples by mapping the browser, credential store, wallet, and

'Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by

'Analyzes loader and dropper samples by identifying staging behavior — embedded or

'Statically analyzes macOS Mach-O malware: parsing the header and load commands,

'Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads

'Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure

'Analyzes malicious Office documents by extracting and reviewing VBA macros and

'Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with

'Analyzes malicious PDF documents: parsing the object structure for JavaScript,

'Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers,

'Analyzes a memory image with Volatility 3 to find malware: rogue processes,

'Analyzes a PE file''s import and export tables to infer capability: mapping imported

'Analyzes position-independent code and shellcode by identifying GetPC/PEB-walk

'Analyzes how a ransomware sample encrypts files: identifying the crypto scheme

'Analyzes remote access trojan command-and-control by mapping the RAT command set,

'Analyzes the PE Rich header and related compiler artifacts to fingerprint the build

'Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling

'Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution

'Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for

'Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite

'Automates radare2/rizin analysis through r2pipe to script function enumeration, string

'Establishes a disciplined malware sample repository: content-addressed storage by

'Frames a structured, testable threat-hunting hypothesis: grounding it in adversary

'Builds reusable malware configuration extractors by applying a declarative JSON spec

'Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs

'Bypasses anti-VM and sandbox checks during analysis by locating the specific detection

'Captures and analyzes malware network traffic from a detonation: extracting C2

'Collects volatile evidence from a potentially compromised host in correct order of

'Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints

'Decrypts statically embedded malware configuration blobs by trying common schemes

'Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs,

'Defeats control-flow-flattening obfuscation by identifying the dispatcher/state-

'Recovers obfuscated strings and resolves dynamically loaded APIs in malware:

'Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets:

'Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string

'Detects process injection in a memory image by identifying private executable regions

'Detects sandbox and analysis evasion techniques in a sample by scanning static

'Compares two related malware samples to surface what changed between variants using

'Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/

'Rebuilds a usable PE file from a memory dump by fixing the section alignment