[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVSW171SXMCPSCSYK03SK6":3,"skill-same:01M6EVSW171SXMCPSCSYK03SK6":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6EVSW171SXMCPSCSYK03SK6","performing-dynamic-analysis-with-any-run",null,"Performs interactive dynamic malware analysis using the ANY.RUN cloud sandbox to observe real-time execution behavior, interact with malware prompts, and capture process trees, network traffic, and system changes. Activates for requests involving interactive sandbox analysis, cloud-based malware detonation, real-time behavioral observation, or ANY.RUN usage.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"run","with","dynamic analysis","performing dynamic analysis with any run","analysis","real-time","ANY.RUN","interactive-analysis","network","command","behavioral","cm","observe","conversion","message","time","malware","de","trees","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-dynamic-analysis-with-any-run\ndescription: 'Performs interactive dynamic malware analysis using the ANY.RUN cloud\n  sandbox to observe real-time execution behavior, interact with malware prompts,\n  and capture process trees, network traffic, and system changes. Activates for requests\n  involving interactive sandbox analysis, cloud-based malware detonation, real-time\n  behavioral observation, or ANY.RUN usage.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- dynamic-analysis\n- sandbox\n- ANY.RUN\n- interactive-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T1591\n---\n\n# Performing Dynamic Analysis with ANY.RUN\n\n## When to Use\n\n- Interactive malware analysis is needed where the analyst must click dialogs, enter credentials, or navigate installer screens\n- Rapid cloud-based sandbox analysis without maintaining local sandbox infrastructure\n- Malware requires user interaction to proceed past anti-sandbox checks (document macros requiring \"Enable Content\")\n- Sharing analysis results with team members via public or private task URLs\n- Comparing behavior across different OS versions (Windows 7, 10, 11) available in ANY.RUN\n\n**Do not use** for highly sensitive samples that cannot be uploaded to cloud services; use an on-premises sandbox like Cuckoo instead.\n\n## Prerequisites\n\n- ANY.RUN account (free community tier or paid subscription at https:\u002F\u002Fany.run)\n- Modern web browser with WebSocket support for interactive session streaming\n- Sample file ready for upload (max 100 MB for free tier, 256 MB for paid)\n- Understanding of the sample type to select appropriate execution environment\n- VPN or secure network for accessing ANY.RUN portal during analysis sessions\n\n## Workflow\n\n### Step 1: Configure Analysis Environment\n\nSet up the ANY.RUN task with appropriate parameters:\n\n```\nANY.RUN Task Configuration:\n━━━━━━━━━━━━━━━━━━━━━━━━━━\nOS Selection:        Windows 10 x64 (recommended default)\n                     Windows 7 x64 (for legacy malware)\n                     Windows 11 x64 (for modern samples)\nExecution Time:      60 seconds (default) \u002F 120-300 for slow-acting malware\nNetwork:             Connected (captures real C2 traffic)\n                     Residential Proxy (bypasses geo-blocking)\nPrivacy:             Public (free tier) \u002F Private (paid - not indexed)\nMITM Proxy:          Enable for HTTPS traffic decryption\nFake Net:            Enable to simulate internet services if sample checks connectivity\n```\n\n**API-based submission (paid tier):**\n```bash\n# Submit file via ANY.RUN API\ncurl -X POST \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -F \"file=@suspect.exe\" \\\n  -F \"env_os=windows\" \\\n  -F \"env_version=10\" \\\n  -F \"env_bitness=64\" \\\n  -F \"opt_timeout=120\" \\\n  -F \"opt_network_connect=true\" \\\n  -F \"opt_privacy_type=bylink\"\n\n# Check task status\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" | jq '.data.status'\n```\n\n### Step 2: Interact with Malware During Execution\n\nUse the interactive session to trigger malware behavior:\n\n```\nInteractive Actions During Analysis:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Document Macros:   Click \"Enable Content\" \u002F \"Enable Editing\" when prompted\n2. Installer Screens: Click through installation dialogs\n3. UAC Prompts:       Click \"Yes\" to allow elevation (observe privilege escalation)\n4. Credential Harvests: Enter fake credentials to observe phishing behavior\n5. Browser Redirects:  Navigate to URLs if malware opens browser windows\n6. File Dialogs:       Select target files if malware presents file picker\n7. Timeout Extension:  Extend analysis time if malware has delayed execution\n```\n\n### Step 3: Analyze Process Tree\n\nReview the complete process execution chain:\n\n```\nProcess Tree Analysis Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nParent-Child Relationships:\n  - WINWORD.EXE -> cmd.exe -> powershell.exe (macro execution chain)\n  - explorer.exe -> suspect.exe -> svchost.exe (process injection)\n\nProcess Events to Note:\n  - Process creation with suspicious command-line arguments\n  - PowerShell with encoded commands (-enc \u002F -encodedcommand)\n  - cmd.exe executing script files (.bat, .vbs, .js)\n  - Legitimate processes spawned from unusual parents\n  - Process termination (self-deletion behavior)\n```\n\n### Step 4: Review Network Activity\n\nExamine DNS, HTTP\u002FHTTPS, and TCP\u002FUDP connections:\n\n```\nANY.RUN Network Panel Analysis:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDNS Requests:\n  - Domain resolutions with threat intelligence tags\n  - Fast-flux or DGA domain patterns\n  - DNS over HTTPS (DoH) detection\n\nHTTP\u002FHTTPS Traffic (with MITM enabled):\n  - Full request\u002Fresponse bodies for HTTP\n  - Decrypted HTTPS traffic showing C2 commands\n  - Downloaded payloads and their content types\n  - POST data containing exfiltrated information\n\nConnection Map:\n  - Geographic visualization of C2 server locations\n  - Connection timeline showing beacon patterns\n  - Suricata alerts triggered on network traffic\n```\n\n### Step 5: Examine IOCs and Threat Intelligence\n\nExtract indicators and map to known threats:\n\n```\nANY.RUN IOC Categories:\n━━━━━━━━━━━━━━━━━━━━━━\nFiles:       Dropped files with hashes, YARA matches, VirusTotal results\nNetwork:     IPs, domains, URLs contacted during execution\nRegistry:    Keys created\u002Fmodified for persistence\nProcesses:   Suspicious process names and command lines\nMutex:       Named mutexes created (used for single-instance checking)\nSignatures:  Suricata rules triggered, behavioral signatures matched\n\nMITRE ATT&CK Mapping:\n  - ANY.RUN automatically maps observed behaviors to ATT&CK techniques\n  - Review the ATT&CK matrix tab for technique coverage\n  - Export ATT&CK Navigator layer for reporting\n```\n\n### Step 6: Export Analysis Results\n\nDownload comprehensive reports and artifacts:\n\n```bash\n# Download report via API\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Freport\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o report.json\n\n# Download PCAP\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Fpcap\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o capture.pcap\n\n# Download dropped files\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Ffiles\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o dropped_files.zip\n\n# Available exports from ANY.RUN web interface:\n# - HTML Report (shareable standalone page)\n# - PCAP file (network traffic capture)\n# - Process dump (memory dumps of processes)\n# - Dropped files (all files created during execution)\n# - MITRE ATT&CK Navigator JSON\n# - IOC export (STIX\u002FJSON\u002FCSV format)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Interactive Sandbox** | Analysis environment allowing real-time analyst interaction with the executing sample, enabling triggering of user-dependent behaviors |\n| **MITM Proxy** | Man-in-the-middle TLS interception in ANY.RUN that decrypts HTTPS traffic for visibility into encrypted C2 communications |\n| **Residential Proxy** | ANY.RUN feature routing malware traffic through residential IP addresses to bypass geo-IP and datacenter-IP evasion checks |\n| **Suricata Alerts** | Network IDS signatures triggered during execution, providing immediate identification of known malicious traffic patterns |\n| **Process Tree** | Hierarchical visualization of parent-child process relationships showing the complete execution chain from initial sample to final payloads |\n| **Behavioral Tags** | ANY.RUN classification labels automatically applied based on observed behavior (e.g., \"trojan\", \"stealer\", \"ransomware\") |\n\n## Tools & Systems\n\n- **ANY.RUN**: Cloud-based interactive malware sandbox providing real-time execution monitoring, process trees, network capture, and MITRE ATT&CK mapping\n- **ANY.RUN API**: REST API for programmatic sample submission, status checking, and report\u002Fartifact retrieval\n- **Suricata**: Integrated network IDS within ANY.RUN providing signature-based detection of malicious network traffic\n- **MITRE ATT&CK Navigator**: Framework integration mapping observed malware behaviors to adversary techniques and tactics\n- **VirusTotal Integration**: Automatic hash lookup of sample and dropped files against VirusTotal detection results\n\n## Common Scenarios\n\n### Scenario: Analyzing a Macro-Enabled Document Requiring User Interaction\n\n**Context**: Phishing email contains a .docm file that requires clicking \"Enable Content\" to trigger the macro payload. Traditional non-interactive sandboxes fail to trigger the malicious behavior.\n\n**Approach**:\n1. Upload .docm to ANY.RUN with Windows 10 environment and Microsoft Office installed\n2. When Word opens and displays the security banner, click \"Enable Content\" interactively\n3. Observe the macro execution in the process tree (Word -> cmd.exe -> powershell.exe)\n4. Monitor network panel for PowerShell downloading second-stage payload\n5. If a UAC prompt appears, click \"Yes\" to allow the payload to observe full behavior chain\n6. Review Suricata alerts for known malware signatures on the downloaded payload\n7. Export IOCs (download URLs, dropped file hashes, C2 domains) for blocking\n\n**Pitfalls**:\n- Forgetting to enable MITM proxy, resulting in encrypted HTTPS traffic without visibility\n- Using too short an execution timeout for malware with delayed execution or sleep timers\n- Uploading to public analysis when the sample contains sensitive organizational data\n- Not clicking through all prompts; some malware requires multiple user interactions to fully execute\n\n## Output Format\n\n```\nANY.RUN ANALYSIS REPORT\n=========================\nTask URL:         https:\u002F\u002Fapp.any.run\u002Ftasks\u002F\u003Ctask_id>\nSample:           invoice_q3.docm\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nVerdict:          MALICIOUS (Score: 95\u002F100)\nFamily:           Emotet\nTags:             [trojan, banker, spam, macro]\n\nPROCESS TREE\nWINWORD.EXE (PID: 2184)\n  └── cmd.exe (PID: 3456) \"\u002Fc powershell -enc JABXAG...\"\n      └── powershell.exe (PID: 4012)\n          └── rundll32.exe (PID: 4568) \"C:\\Users\\...\\payload.dll,Control_RunDLL\"\n\nNETWORK INDICATORS\nDNS:    update.emotet-c2[.]com -> 185.220.101.42\nHTTPS:  POST hxxps:\u002F\u002F185.220.101[.]42\u002Fwp-content\u002Fgate\u002F (C2 beacon)\nHTTP:   GET hxxp:\u002F\u002Fcompromised-site[.]com\u002Finvoice.dll (payload download)\n\nSURICATA ALERTS\n[1:2028401] ET MALWARE Emotet CnC Beacon\n[1:2028402] ET MALWARE Win32\u002FEmotet Activity\n\nMITRE ATT&CK TECHNIQUES\nT1566.001  Phishing: Spearphishing Attachment\nT1204.002  User Execution: Malicious File\nT1059.001  Command and Scripting Interpreter: PowerShell\nT1218.011  Rundll32 Execution\nT1071.001  Application Layer Protocol: Web Protocols\n\nDROPPED FILES\npayload.dll  SHA-256: abc123... Detection: 48\u002F72 (VirusTotal)\nconfig.dat   SHA-256: def456... (encrypted configuration)\n```\n","# Performing Dynamic Analysis with ANY.RUN\n\n## When to Use\n\n- Interactive malware analysis is needed where the analyst must click dialogs, enter credentials, or navigate installer screens\n- Rapid cloud-based sandbox analysis without maintaining local sandbox infrastructure\n- Malware requires user interaction to proceed past anti-sandbox checks (document macros requiring \"Enable Content\")\n- Sharing analysis results with team members via public or private task URLs\n- Comparing behavior across different OS versions (Windows 7, 10, 11) available in ANY.RUN\n\n**Do not use** for highly sensitive samples that cannot be uploaded to cloud services; use an on-premises sandbox like Cuckoo instead.\n\n## Prerequisites\n\n- ANY.RUN account (free community tier or paid subscription at https:\u002F\u002Fany.run)\n- Modern web browser with WebSocket support for interactive session streaming\n- Sample file ready for upload (max 100 MB for free tier, 256 MB for paid)\n- Understanding of the sample type to select appropriate execution environment\n- VPN or secure network for accessing ANY.RUN portal during analysis sessions\n\n## Workflow\n\n### Step 1: Configure Analysis Environment\n\nSet up the ANY.RUN task with appropriate parameters:\n\n```\nANY.RUN Task Configuration:\n━━━━━━━━━━━━━━━━━━━━━━━━━━\nOS Selection:        Windows 10 x64 (recommended default)\n                     Windows 7 x64 (for legacy malware)\n                     Windows 11 x64 (for modern samples)\nExecution Time:      60 seconds (default) \u002F 120-300 for slow-acting malware\nNetwork:             Connected (captures real C2 traffic)\n                     Residential Proxy (bypasses geo-blocking)\nPrivacy:             Public (free tier) \u002F Private (paid - not indexed)\nMITM Proxy:          Enable for HTTPS traffic decryption\nFake Net:            Enable to simulate internet services if sample checks connectivity\n```\n\n**API-based submission (paid tier):**\n```bash\n# Submit file via ANY.RUN API\ncurl -X POST \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -F \"file=@suspect.exe\" \\\n  -F \"env_os=windows\" \\\n  -F \"env_version=10\" \\\n  -F \"env_bitness=64\" \\\n  -F \"opt_timeout=120\" \\\n  -F \"opt_network_connect=true\" \\\n  -F \"opt_privacy_type=bylink\"\n\n# Check task status\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" | jq '.data.status'\n```\n\n### Step 2: Interact with Malware During Execution\n\nUse the interactive session to trigger malware behavior:\n\n```\nInteractive Actions During Analysis:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Document Macros:   Click \"Enable Content\" \u002F \"Enable Editing\" when prompted\n2. Installer Screens: Click through installation dialogs\n3. UAC Prompts:       Click \"Yes\" to allow elevation (observe privilege escalation)\n4. Credential Harvests: Enter fake credentials to observe phishing behavior\n5. Browser Redirects:  Navigate to URLs if malware opens browser windows\n6. File Dialogs:       Select target files if malware presents file picker\n7. Timeout Extension:  Extend analysis time if malware has delayed execution\n```\n\n### Step 3: Analyze Process Tree\n\nReview the complete process execution chain:\n\n```\nProcess Tree Analysis Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nParent-Child Relationships:\n  - WINWORD.EXE -> cmd.exe -> powershell.exe (macro execution chain)\n  - explorer.exe -> suspect.exe -> svchost.exe (process injection)\n\nProcess Events to Note:\n  - Process creation with suspicious command-line arguments\n  - PowerShell with encoded commands (-enc \u002F -encodedcommand)\n  - cmd.exe executing script files (.bat, .vbs, .js)\n  - Legitimate processes spawned from unusual parents\n  - Process termination (self-deletion behavior)\n```\n\n### Step 4: Review Network Activity\n\nExamine DNS, HTTP\u002FHTTPS, and TCP\u002FUDP connections:\n\n```\nANY.RUN Network Panel Analysis:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nDNS Requests:\n  - Domain resolutions with threat intelligence tags\n  - Fast-flux or DGA domain patterns\n  - DNS over HTTPS (DoH) detection\n\nHTTP\u002FHTTPS Traffic (with MITM enabled):\n  - Full request\u002Fresponse bodies for HTTP\n  - Decrypted HTTPS traffic showing C2 commands\n  - Downloaded payloads and their content types\n  - POST data containing exfiltrated information\n\nConnection Map:\n  - Geographic visualization of C2 server locations\n  - Connection timeline showing beacon patterns\n  - Suricata alerts triggered on network traffic\n```\n\n### Step 5: Examine IOCs and Threat Intelligence\n\nExtract indicators and map to known threats:\n\n```\nANY.RUN IOC Categories:\n━━━━━━━━━━━━━━━━━━━━━━\nFiles:       Dropped files with hashes, YARA matches, VirusTotal results\nNetwork:     IPs, domains, URLs contacted during execution\nRegistry:    Keys created\u002Fmodified for persistence\nProcesses:   Suspicious process names and command lines\nMutex:       Named mutexes created (used for single-instance checking)\nSignatures:  Suricata rules triggered, behavioral signatures matched\n\nMITRE ATT&CK Mapping:\n  - ANY.RUN automatically maps observed behaviors to ATT&CK techniques\n  - Review the ATT&CK matrix tab for technique coverage\n  - Export ATT&CK Navigator layer for reporting\n```\n\n### Step 6: Export Analysis Results\n\nDownload comprehensive reports and artifacts:\n\n```bash\n# Download report via API\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Freport\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o report.json\n\n# Download PCAP\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Fpcap\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o capture.pcap\n\n# Download dropped files\ncurl \"https:\u002F\u002Fapi.any.run\u002Fv1\u002Fanalysis\u002F$TASK_ID\u002Ffiles\" \\\n  -H \"Authorization: API-Key $ANYRUN_API_KEY\" \\\n  -o dropped_files.zip\n\n# Available exports from ANY.RUN web interface:\n# - HTML Report (shareable standalone page)\n# - PCAP file (network traffic capture)\n# - Process dump (memory dumps of processes)\n# - Dropped files (all files created during execution)\n# - MITRE ATT&CK Navigator JSON\n# - IOC export (STIX\u002FJSON\u002FCSV format)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Interactive Sandbox** | Analysis environment allowing real-time analyst interaction with the executing sample, enabling triggering of user-dependent behaviors |\n| **MITM Proxy** | Man-in-the-middle TLS interception in ANY.RUN that decrypts HTTPS traffic for visibility into encrypted C2 communications |\n| **Residential Proxy** | ANY.RUN feature routing malware traffic through residential IP addresses to bypass geo-IP and datacenter-IP evasion checks |\n| **Suricata Alerts** | Network IDS signatures triggered during execution, providing immediate identification of known malicious traffic patterns |\n| **Process Tree** | Hierarchical visualization of parent-child process relationships showing the complete execution chain from initial sample to final payloads |\n| **Behavioral Tags** | ANY.RUN classification labels automatically applied based on observed behavior (e.g., \"trojan\", \"stealer\", \"ransomware\") |\n\n## Tools & Systems\n\n- **ANY.RUN**: Cloud-based interactive malware sandbox providing real-time execution monitoring, process trees, network capture, and MITRE ATT&CK mapping\n- **ANY.RUN API**: REST API for programmatic sample submission, status checking, and report\u002Fartifact retrieval\n- **Suricata**: Integrated network IDS within ANY.RUN providing signature-based detection of malicious network traffic\n- **MITRE ATT&CK Navigator**: Framework integration mapping observed malware behaviors to adversary techniques and tactics\n- **VirusTotal Integration**: Automatic hash lookup of sample and dropped files against VirusTotal detection results\n\n## Common Scenarios\n\n### Scenario: Analyzing a Macro-Enabled Document Requiring User Interaction\n\n**Context**: Phishing email contains a .docm file that requires clicking \"Enable Content\" to trigger the macro payload. Traditional non-interactive sandboxes fail to trigger the malicious behavior.\n\n**Approach**:\n1. Upload .docm to ANY.RUN with Windows 10 environment and Microsoft Office installed\n2. When Word opens and displays the security banner, click \"Enable Content\" interactively\n3. Observe the macro execution in the process tree (Word -> cmd.exe -> powershell.exe)\n4. Monitor network panel for PowerShell downloading second-stage payload\n5. If a UAC prompt appears, click \"Yes\" to allow the payload to observe full behavior chain\n6. Review Suricata alerts for known malware signatures on the downloaded payload\n7. Export IOCs (download URLs, dropped file hashes, C2 domains) for blocking\n\n**Pitfalls**:\n- Forgetting to enable MITM proxy, resulting in encrypted HTTPS traffic without visibility\n- Using too short an execution timeout for malware with delayed execution or sleep timers\n- Uploading to public analysis when the sample contains sensitive organizational data\n- Not clicking through all prompts; some malware requires multiple user interactions to fully execute\n\n## Output Format\n\n```\nANY.RUN ANALYSIS REPORT\n=========================\nTask URL:         https:\u002F\u002Fapp.any.run\u002Ftasks\u002F\u003Ctask_id>\nSample:           invoice_q3.docm\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nVerdict:          MALICIOUS (Score: 95\u002F100)\nFamily:           Emotet\nTags:             [trojan, banker, spam, macro]\n\nPROCESS TREE\nWINWORD.EXE (PID: 2184)\n  └── cmd.exe (PID: 3456) \"\u002Fc powershell -enc JABXAG...\"\n      └── powershell.exe (PID: 4012)\n          └── rundll32.exe (PID: 4568) \"C:\\Users\\...\\payload.dll,Control_RunDLL\"\n\nNETWORK INDICATORS\nDNS:    update.emotet-c2[.]com -> 185.220.101.42\nHTTPS:  POST hxxps:\u002F\u002F185.220.101[.]42\u002Fwp-content\u002Fgate\u002F (C2 beacon)\nHTTP:   GET hxxp:\u002F\u002Fcompromised-site[.]com\u002Finvoice.dll (payload download)\n\nSURICATA ALERTS\n[1:2028401] ET MALWARE Emotet CnC Beacon\n[1:2028402] ET MALWARE Win32\u002FEmotet Activity\n\nMITRE ATT&CK TECHNIQUES\nT1566.001  Phishing: Spearphishing Attachment\nT1204.002  User Execution: Malicious File\nT1059.001  Command and Scripting Interpreter: PowerShell\nT1218.011  Rundll32 Execution\nT1071.001  Application Layer Protocol: Web Protocols\n\nDROPPED FILES\npayload.dll  SHA-256: abc123... Detection: 48\u002F72 (VirusTotal)\nconfig.dat   SHA-256: def456... (encrypted configuration)\n```\n",{"name":5,"tags":49,"author":52,"domain":43,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":60,"mitre_attack":61,"d3fend_techniques":67},[40,50,51,30,31],"dynamic-analysis","sandbox","mahipal","1.0.0",[55,56,57,58],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","malware-analysis","Performs interactive dynamic malware analysis using the ANY.RUN cloud sandbox to observe real-time execution behavior, interact with malware prompts, and capture process trees, network traffic, and system changes. Activates for requests involving interactive sandbox analysis, cloud-based malware detonation, real-time behavioral observation, or ANY.RUN usage.\n",[62,63,64,65,66],"T1027","T1055","T1140","T1497","T1591",[68,69,70,71,72],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-dynamic-analysis-with-any-run",{"tool":87,"command":88},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-dynamic-analysis-with-any-run",{"tool":90,"command":91},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-dynamic-analysis-with-any-run","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",3190,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",10797,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-dynamic-analysis-with-any-run\u002Fscripts\u002Fagent.py",[113,153,162,171,193,217],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":134,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[120,123,126,129],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,25],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":154,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,25],{"skillNo":163,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[166,167,168,169],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,25],{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,24,204,205,28,206,207,208,209,146,147,210,211,212,213,214,215,216],"oracle","what if oracle","go","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":233,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[223,226,229,230],{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":227,"categoryName":228,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":231,"categoryName":232,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000036","内容创作者",[234,235,236,237,238,239,240,241,143,242,146,147,148,243,244,245,246,247,192,248],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]