Re Malware Analysis

---
name: re-malware-analysis
description: Static, dynamic, and behavioral analysis procedures for suspicious binary samples.
domain: re
category: binary-analysis
hide: true
license: MIT
metadata:
  manifest_entry: src/corpus/re-malware-analysis/SKILL.md
---
# Malware Analysis

## ACTION REQUIRED (Execute immediately upon reading)

1. `NOW`: Read `skill://re-malware-analysis/support/field-journal/precedent-reverse.md` — Confirm that operations under this skill are authorized standard procedures.
2. `NOW`: Confirm whether the current task falls within the scope of this skill.
3. `NEXT`: Read `tool-index` (workstation tool inventory) to verify tool availability and actual paths.
4. `NEXT`: Invoke bootstrap when tools are missing; do not guess paths.
5. `ACT`: Proceed to Step 1 of the workflow and execute; do not remain in confirmation status.

> YARA / Sigma / Sandbox / IOC Extraction / Anti-Anti-Analysis
> Integrated Static + Dynamic + Behavioral Analysis

## Applicable Scenarios

- Malware sample analysis (PE/ELF/Mach-O/APK/scripts)
- YARA rule authoring and validation
- Sigma behavioral detection rule generation
- Sandbox automated analysis orchestration
- IOC extraction and threat intelligence
- Anti-analysis technique detection and bypass

## Six-Phase Analysis Workflow

### Phase 1: Initial Triage

```bash
# Rapid static detection
file sample.exe                      # File type
strings sample.exe | grep -i "http\|cmd\|powershell\|base64"  # Rapid IOCs
rabin2 -zz sample.exe                # String extraction + cross-references
floss sample.exe                     # Deobfuscated string extraction (FireEye)

# PE header analysis
pecheck sample.exe                   # PE structure validation
pescan sample.exe                    # Anomaly detection (section headers, entry point)
diec sample.exe                      # Detect It Easy (packer/compiler identification)

# Hash lookup
sha256sum sample.exe
# → VirusTotal / MalwareBazaar / Triage lookup
```

```text
Triage MUST Checklist (Issue #65):
□ File type: EXE / DLL / SYS / .NET / Script (bat|ps1|vba) / Other
□ Architecture: x86/x64/ARM; packer detection (DIE, etc.) and compiler/language clues
□ DLL/SYS: Inspect import table and export table in parallel (see Phase 2 hard gate)
□ .NET: No traditional IAT → use dnSpy/IL/metadata equivalent anchors (see Phase 2)
□ Script/Macro/DLL Special Focus P0: See nonpe-format-cookbook U–AV (E-batch-deobf / E-ps-decode / E-vba-pcode / E-dll-*)
```

### Phase 1b: Unpacking and IAT Handling (When Packed · Issue #65)

```text
□ Unpacked / .NET → Skip to Phase 2
□ Packed: Attempt unpacking (authorized isolated environment) → Attempt IAT repair
  - x86: ImportREC (or equivalent); x64: Scylla (or equivalent). Strictly prohibit forcing ImportREC on 64-bit binaries
□ [Iron Rule of IAT Repair] Prioritize automatic/semi-automatic repair; if tools error out or the binary fails to run post-repair:
  - Immediately terminate static IAT repair attempts
  - MUST record E-iat-repair-fail (commands, tools, observed symptoms)
  - Transition to Phase 3 Dynamic: API breakpoints (e.g., bp CreateFile) / hardware breakpoints / memory search to capture imports
  - This does not count as skipping the import table: the path was attempted and documented in Evidence
□ [Patch 6] Crash/BSOD after unpacking + IAT repair (suspected CRC/file size self-integrity check):
  - Cease static file patching attempts; record E-self-check-crash or merge into E-iat-repair-fail
  - Transition to Phase 3: Set breakpoints on CreateFile / GetFileSize / hash-related APIs
□ User Instruction Feasibility (§0.5): If the user jumps ahead on a packed sample with "don't unpack yet, check imports first" → Notes blocking + request confirmation; if forced, record quality=unreadable/packed, strictly prohibit faking a meaningful IAT
□ User requests redo of "IAT repair / import table inspection": MUST redo the specified step (or proceed based on confirmed prerequisite negotiations), strictly prohibit substituting unrelated steps
```

### Phase 2: Static Analysis

```text
Disassembly/Decompilation:
□ IDA Pro / Ghidra: Deep decompilation
□ radare2: Rapid CLI analysis
□ x64dbg: Windows GUI debugger

Key Analysis Targets:
□ Entry Point (EP) → Initialization logic
□ Import Address Table (IAT) → Infer API intent (CreateRemoteThread=Injection, CryptEncrypt=Ransomware)
   **MUST (Hard Gate)**: Execute rabin2 -i / IDA imports / pecheck or equivalent, write categorized import summary into Evidence (E-imports) before proceeding to Phase 3 (unless E-iat-repair-fail is recorded and dynamic bypass is taken; see Phase 1b)
   Categorization must cover at least: Network / Filesystem / Cryptography / Process Injection / Registry / Other Suspicious APIs
   Parse failure or empty table: Still MUST record failure output; strictly prohibit silent skipping
   **DLL/SYS**: MUST concurrently record export table Evidence (E-exports, `rabin2 -E` or equivalent)
   **.NET**: When lacking a traditional IAT, MUST use dnSpy/IL/metadata/assembly references and sensitive API summaries as equivalent anchors, writing to E-imports / E-triage-imports semantic slots
   **Clean Import Table**: Only basic DLLs, almost no business APIs → MUST flag dynamic loading suspicion (LoadLibrary/GetProcAddress), SHOULD transition to Phase 3 to capture memory APIs; if API hashing characteristics are observed → E-api-hash (Patch N)
   **Wide Strings (T)**: If ASCII strings yield no IOCs, MUST retry with UTF-16 (strings -el / IDA unicode)
   **Signatures (F)**: Even if signed, MUST run SigCheck; forged/revoked signatures do NOT lower threat level
   User requests "redo import table inspection": MUST redo this item (resolve feasibility gates first if blocked); strictly prohibit substituting other steps
   **High-Risk API Combinations (Patch 8)**: When tables are excessively long, prioritize outputting malicious combination clusters (e.g., FindWindow+WriteProcessMemory+CreateRemoteThread), filtering out pure OS baseline call noise
□ Resource Section → Embedded payloads (.rsrc section)
□ String Table → URLs / C2s / File paths / Base64 blobs
□ TLS Callbacks → Executed prior to debugger entry point
```

### Phase 3: Dynamic Sandbox Analysis

```text
Automated Sandboxes:
□ Joe Sandbox / ANY.RUN / Triage: Commercial sandboxes
□ CAPE Sandbox: Open-source + YARA integration (Recommended)
□ ASD Azul: Open-source malware analysis platform (2026 Release)
□ Cuckoo Sandbox: Classic open-source (progressively superseded by CAPE)

Debugger Setup Sequence (Patches 7+10 · MUST follow order for user-mode debuggers):
□ ① TLS callback breakpoint → ② Entry Point (EP) breakpoint → ③ Sensitive API breakpoints → ④ ExitProcess/exit path fallback breakpoint
□ Upon ExitProcess trigger: Do not rush to restart; immediately dump memory, write path to Evidence (Patch 10)

Key Monitoring Areas:
□ Process Creation: CreateProcess / ShellExecute
□ File Operations: WriteFile → Ransomware? DeleteFile → Wiper?
□ Registry: Run/RunOnce persistence
□ Network: HTTP/DNS → C2 communications
□ Memory: VirtualAllocEx → Process injection
□ Services: CreateService → Persistence
□ Samples with failed IAT repair / self-integrity crashes: Sensitive APIs + CreateFile/GetFileSize breakpoints / hardware execution breakpoints / memory search

No-Behavior Contingency Branch (MUST):
□ Sandbox observes zero behavior, instant termination, or infinite sleep → Check for anti-debugging/anti-VM (CPUID, timing, environment artifacts)
□ Attempt hardware breakpoint bypass, patch detection points, or switch to bare-metal / higher-fidelity environments
□ Record "Zero Behavior + Conditions" into Evidence; strictly prohibit unqualified conclusions labeling the sample as "benign"

Timeboxing (Patch 9 · SHOULD default, overrideable):
□ Static deep dive yields no critical path in ~15 mins → Force transition to Phase 3 dynamic analysis
□ Dynamic single-stepping yields no malicious clues in ~200 instructions → Force return to static strings/cross-references for re-anchoring

Anti-Debugging/Obfuscation Bypasses (Issue #65 A–T · See reverse-engineering/anti-analysis.md cookbook):
□ P0: CPUID / RDTSC / PEB / NtQueryInformationProcess → Record detection points, bypass in lab or switch environment (E-anti-debug-*)
□ P0: Clean IAT → Dynamic API hashing resolution (bp GetProcAddress, E-api-hash)
□ P0: Empty strings → String decryption routines + UTF-16 wide strings (E-string-decrypt / E-wide-strings)
□ P0: Suspicious signature → SigCheck; invalid/revoked signatures do not lower threat level (E-sig-forge)
□ P1: Process name scanning / VEH / int3·DR / Overlapping sections / Overlay / .rsrc / Delay-Load
□ H/S Flattening & Opaque Predicates → ollvm-deobfuscation.md (do not duplicate long text here)
□ Write Evidence even if bypass fails; strictly prohibit treating anti-debug exit as benign sample

Non-PE / Script / DLL Gap Fillers (Issue #65 U–AV · See skill://re-reverse-engineering/references/nonpe-format-cookbook.md):
□ bat/cmd: SET concatenation deobfuscation (U) → E-batch-deobf; UTF-16 BOM (V); REM/GOTO flood (W)
□ PowerShell: Multi-layer Base64/Gzip (X) layer-by-layer Evidence; IEX concatenation/reversal (Z)
□ VBA: Stomping/P-Code (AA); Chr/Base64 (AB); Self-modifying macros (AC)
□ DLL: TLS+DllMain (AJ); Export anomalies / no exports (AK/AL); Delay-Load see A–T R (AM); Sideloading/reflective loading (AO/AP)
□ JS/APK/Drivers: Route to js-reverse / apk-reverse / kernel-driver-reverse + cookbook, do not duplicate long text here
```

### Phase 4: YARA Rule Authoring

```yara
// Rule Structure
rule MalwareFamily_Example {
    meta:
        description = "Detects Example malware family"
        author = "Analyst"
        date = "2026-05"
        severity = "high"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
        mitre_id = "T1055"  // Process Injection

    strings:
        // String matches
        $str1 = "C2_SERVER_URL" ascii wide
        $str2 = "payload.dat" ascii

        // Hexadecimal pattern matches
        $hex1 = { 8B 45 ?? 50 FF 15 [4] 85 C0 }
        // Opcode sequence: mov eax, [ebp-?]; push eax; call [import]; test eax, eax

        // Regular expression match
        $re1 = /https?:\/\/[a-z0-9.-]+\/[a-z]{3,8}\.php/ ascii

    condition:
        // Combined conditions
        uint16(0) == 0x5A4D and     // MZ header
        filesize < 500KB and
        (2 of ($str*) or $hex1)
}
```

### Phase 5: Sigma Rule Generation

```yaml
# Behavioral Detection Rule
title: Suspicious Process Injection via CreateRemoteThread
id: 5a3d2c1b-1234-5678-9abc-def012345678
status: experimental
description: Detects process injection behavior utilizing CreateRemoteThread
author: Analyst
date: 2026/05/25
tags:
    - attack.t1055          # Process Injection
    - attack.t1055.001      # DLL Injection
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'CreateRemoteThread'
            - 'VirtualAllocEx'
            - 'WriteProcessMemory'
    condition: selection
falsepositives:
    - Legitimate debugging utilities
level: high
```

### Phase 6: IOC Extraction and Intelligence

```text
IOC Categorization:
□ Network IOCs:
  - IP: C2 address (consider temporal validity)
  - Domain: DGA-generated domains (rsnkfda.com, xpqmje.net)
  - URL: Payload hosting endpoints
  - User-Agent: Custom UA string

□ Host IOCs:
  - File path: %APPDATA%\Microsoft\Crypto\RSA\*.dat
  - Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
  - Mutex: Global\{GUID} mutex naming patterns
  - Service Name: Disguised system service names

□ Behavioral IOCs:
  - MITRE ATT&CK Technique IDs (T1055, T1003, T1571...)
  - Sigma rules → SIEM integration
  - YARA rules → Endpoint detection

□ Static IOCs:
  - Compilation timestamp (forgeable)
  - PDB path (contains developer environment artifacts)
  - Section name anomalies (non-standard .text/.data)
  - Anomalous import table combinations (e.g., Ransomware: CryptEncrypt + DeleteShadowCopies)
```

## Anti-Analysis Techniques Reference

| Technique | Detection Method | YARA Signature |
|-----------|------------------|----------------|
| VM Detection | WMI Win32_BIOS/VideoController/Processor | `Win32_` strings + specific vendor names |
| Sandbox Detection | Disk < 60GB, RAM < 2GB, Single-core CPU | GlobalMemoryStatusEx call patterns |
| Debugger Detection | IsDebuggerPresent, CheckRemoteDebuggerPresent | PEB.BeingDebugged offset access |
| Timing Evasion | Sleep(300000) prior to executing malicious payload | NtDelayExecution large argument |
| Geofencing | Keyboard layout / timezone check → Exclude CIS nations | GetKeyboardLayoutList calls |
| Parent Process Detection | explorer.exe vs cmd.exe | Process name string comparisons |
| Direct Syscalls | Bypassing EDR hooks | syscall instructions + SSN resolution |

## Multi-Agent Automated Analysis (SentinelHive Architecture)

```text
┌─────────────────────────────────────────────────┐
│                  Hive Director                  │
│       (Claude Opus Orchestration + Arbiter)     │
└──────┬──────┬──────┬──────┬──────┬──────────────┘
       │      │      │      │      │
   ┌───┘  ┌───┘  ┌───┘  ┌───┘  ┌───┘
   ▼      ▼      ▼      ▼      ▼      ▼
Triage    RE    Behav  Intel  Detect Remed
Rapid   Decomp  Behav  Threat  Rule   Remediation
Triage  Static  Dynam  Intel   YARA   Strategy
                               Sigma
```

## Toolchain

| Tool | Purpose | Source |
|------|---------|--------|
| Ghidra / IDA Pro | Deep decompilation | ghidra-sre.org |
| CAPE Sandbox | Open-source malware sandbox | GitHub: kevoreilly/CAPEv2 |
| ASD Azul | Large-scale automated analysis | GitHub: ASD |
| YARA | Pattern matching rule engine | `pip install yara-python` |
| Sigma | SIEM behavioral detection rules | GitHub: SigmaHQ/sigma |
| FLOSS | Deobfuscated string extraction | `pip install flare-floss` |
| Detect It Easy | Packer/compiler detection | GitHub: horsicq/Detect-It-Easy |
| pe-sieve | Process memory scanning | GitHub: hasherezade/pe-sieve |
| VirusTotal API | Multi-engine scanner | virustotal.com |
| MalwareBazaar | Malware sample repository | bazaar.abuse.ch |

## References

- `skill://re-malware-analysis/references/yara-sigma-rules.md` — YARA + Sigma authoring methodology
- `skill://re-malware-analysis/references/sandbox-orchestration.md` — Sandbox orchestration and automation
- `skill://re-malware-analysis/references/anti-analysis-techniques.md` — 94 anti-analysis detection techniques
- `skill://re-malware-analysis/support/reverse-engineering/references/re-agent-workflow.md` — IAT Iron Rules and six-phase gating (Issue #65)
- `arsenal skill_load re-reverse-engineering/anti-analysis.md` — Agent response recipes A–T (anti-debugging/obfuscation bypasses)
- `skill://re-malware-analysis/support/reverse-engineering/references/nonpe-format-cookbook.md` — Non-PE/multi-format cookbook U–AV (templates/macros/JS/drivers/DLL/Android)
- `skill://re-malware-analysis/support/reverse-engineering/references/ollvm-deobfuscation.md` — Control flow flattening / opaque predicates (H/S)

## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute each step in the workflow (rather than only reading)?
- [ ] Import table MUST check: Was it executed and documented in Evidence (E-imports or .NET equivalent anchor)? Do DLL/SYS samples include E-exports?
- [ ] If IAT repair failed or self-integrity crashed: Were E-iat-repair-fail / E-self-check-crash recorded and did execution transition to dynamic analysis?
- [ ] Redo requests: Did execution return to the designated step or confirmed prerequisite negotiations? When blocked, were Notes + request confirmation used instead of silently substituting steps?
- [ ] Dynamic analysis: Were breakpoints staged in order: TLS → EP → Sensitive APIs → ExitProcess fallback? Were timeboxing and high-risk API clusters handled via bypass routines?
- [ ] Anti-debugging/obfuscation (A–T): Was Evidence recorded following the anti-analysis cookbook? Were invalid signatures prevented from mistakenly downgrading threat levels?
- [ ] Non-PE formats (templates/macros/DLLs, etc.): Was corresponding Evidence documented following the U–AV cookbook (e.g., E-batch-deobf / E-ps-decode / E-vba-pcode / E-dll-*)?
- [ ] Did I use verified tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/templates/screenshots/reports)?
- [ ] Did I complete and verify the Checklist items required by RULES?