Malware Analysis Claude Skills

Malware Analysis Skills Toolkit

**Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).**

💡 **Want to learn the manual analysis techniques behind these skills?** Check out the comprehensive [Malware Analysis SOP](https://gl0bal01.com/intel-codex/Security/Analysis/sop-malware-analysis) covering traditional analysis methods and tools.

---

📦 What's Included

**1 Orchestrator + 5 Sub-Skills + host-side scripts** covering triage, dynamic analysis, detection engineering, and reporting. The skills are written as instructions to Claude Code: Claude runs the static tooling, parses exported evidence, writes and tests the rules, and drafts the report. You execute the sample in your isolated VM; everything else is done for you.

• SKILL.md (root) - Orchestrator — single entry point that routes to the right sub-skill, manages analysis state across phases, and supports multi-sample batch workflows. Just describe what you need.

1. malware-triage - Initial assessment and prioritization
2. malware-dynamic-analysis - Safe execution and behavior monitoring
3. specialized-file-analyzer - Non-PE file analysis (.NET, Office, PDF, scripts, HTA, disk images)
4. detection-engineer - Detection rules and IOC management
5. malware-report-writer - Professional report creation

---

🧠 How It Works (agentic)

These are not tutorials you read — they are instructions Claude Code executes. Claude runs the static tools on the host, parses the evidence you export from the VM, and produces the rules and report. The only manual step is detonating the sample in your isolated VM.

                          YOUR HOST (Claude Code + internet)
  ┌───────────────────────────────────────────────────────────────────────┐
  │  Triage            Claude runs: file · hash_calculator.py · pe_info.py  │
  │