Perform Static Malware Analysis

---
name: perform-static-malware-analysis
description: Analyze a suspicious artifact without executing it. Use for binaries, apps, packages, archives, scripts, libraries, extensions, firmware, or payloads when metadata, signatures, imports, strings, resources, and obfuscation need inspection.
---

# Perform Static Malware Analysis

## Overview

Build a capability hypothesis from preserved bytes and structure. Keep every source-level or behavioral claim bounded by what static evidence can actually prove.

Read [references/static-analysis-layers.md](references/static-analysis-layers.md) for layered checks and escalation criteria.

## Workflow

1. Establish artifact identity and working copy.
2. Inspect outer structure.
   - Identify formats, architectures, bundles, packages, sections, members, overlays, embedded resources, signatures, timestamps, and declared permissions.
3. Extract low-risk indicators.
   - Collect imports/exports, linked libraries, symbols, strings, URLs/domains, paths, commands, mutex/service names, configuration, certificates, and persistence references.
4. Inspect code and content shape.
   - Identify interpreters, entry points, packers/obfuscation, encrypted blobs, staged payloads, anti-analysis checks, and unusual executable mappings.
   - Use YARA-X or other local rules as evidence with rule/version recorded.
5. Form capability hypotheses.
   - Map evidence to possible execution, persistence, discovery, credential, collection, command-and-control, exfiltration, or defense-evasion behavior.
   - Separate present code from reachable behavior and capability from observed execution.
6. Escalate deliberately.
   - Use `reverse-engineering-skills` for control flow, decompilation, protocol/config recovery, or exact binary comparisons.
   - Use dynamic analysis only after isolation selection and a clear observation plan.

## Output

Return identity, structure, indicators, likely capabilities, contradictory evidence, obfuscation/coverage limits, confidence, and the smallest next analysis step.