[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EZ4H2TKT5AC3FBG5QWN50B":3,"skill-same:01M6EZ4H2TKT5AC3FBG5QWN50B":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6EZ4H2TKT5AC3FBG5QWN50B","malware-analyst",null,"Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static\u002Fdynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fmalware-analyst\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"malware","analyst","malware analyst","behavioral","hunting","identification","dynamic analysis","security research","incident","intelligence","expert","sandbox","threat","ioc extraction","analysis","ioc","threat intelligence","threat hunting","incident response","security","2026-11-10 10:12:30",false,"---\nname: malware-analyst\ndescription: Expert malware analyst specializing in defensive malware research,\n  threat intelligence, and incident response. Masters sandbox analysis,\n  behavioral analysis, and malware family identification. Handles static\u002Fdynamic\n  analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage,\n  threat hunting, incident response, or security research.\nmetadata:\n  model: opus\n---\n\n# File identification\nfile sample.exe\nsha256sum sample.exe\n\n# String extraction\nstrings -a sample.exe | head -100\nFLOSS sample.exe  # Obfuscated strings\n\n# Packer detection\ndiec sample.exe   # Detect It Easy\nexeinfope sample.exe\n\n# Import analysis\nrabin2 -i sample.exe\ndumpbin \u002Fimports sample.exe\n```\n\n### Phase 3: Static Analysis\n1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja\n2. **Identify main functionality**: Entry point, WinMain, DllMain\n3. **Map execution flow**: Key decision points, loops\n4. **Identify capabilities**: Network, file, registry, process operations\n5. **Extract IOCs**: C2 addresses, file paths, mutex names\n\n### Phase 4: Dynamic Analysis\n```\n1. Environment Setup:\n   - Windows VM with common software installed\n   - Process Monitor, Wireshark, Regshot\n   - API Monitor or x64dbg with logging\n   - INetSim or FakeNet for network simulation\n\n2. Execution:\n   - Start monitoring tools\n   - Execute sample\n   - Observe behavior for 5-10 minutes\n   - Trigger functionality (connect to network, etc.)\n\n3. Documentation:\n   - Network connections attempted\n   - Files created\u002Fmodified\n   - Registry changes\n   - Processes spawned\n   - Persistence mechanisms\n```\n\n## Use this skill when\n\n- Working on file identification tasks or workflows\n- Needing guidance, best practices, or checklists for file identification\n\n## Do not use this skill when\n\n- The task is unrelated to file identification\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Common Malware Techniques\n\n### Persistence Mechanisms\n```\nRegistry Run keys       - HKCU\u002FHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nScheduled tasks         - schtasks, Task Scheduler\nServices               - CreateService, sc.exe\nWMI subscriptions      - Event subscriptions for execution\nDLL hijacking          - Plant DLLs in search path\nCOM hijacking          - Registry CLSID modifications\nStartup folder         - %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\nBoot records           - MBR\u002FVBR modification\n```\n\n### Evasion Techniques\n```\nAnti-VM                - CPUID, registry checks, timing\nAnti-debugging         - IsDebuggerPresent, NtQueryInformationProcess\nAnti-sandbox           - Sleep acceleration detection, mouse movement\nPacking                - UPX, Themida, VMProtect, custom packers\nObfuscation           - String encryption, control flow flattening\nProcess hollowing      - Inject into legitimate process\nLiving-off-the-land    - Use built-in tools (PowerShell, certutil)\n```\n\n### C2 Communication\n```\nHTTP\u002FHTTPS            - Web traffic to blend in\nDNS tunneling         - Data exfil via DNS queries\nDomain generation     - DGA for resilient C2\nFast flux             - Rapidly changing DNS\nTor\u002FI2P               - Anonymity networks\nSocial media          - Twitter, Pastebin as C2 channels\nCloud services        - Legitimate services as C2\n```\n\n## Tool Proficiency\n\n### Analysis Platforms\n```\nCuckoo Sandbox       - Open-source automated analysis\nANY.RUN              - Interactive cloud sandbox\nHybrid Analysis      - VirusTotal alternative\nJoe Sandbox          - Enterprise sandbox solution\nCAPE                 - Cuckoo fork with enhancements\n```\n\n### Monitoring Tools\n```\nProcess Monitor      - File, registry, process activity\nProcess Hacker       - Advanced process management\nWireshark            - Network packet capture\nAPI Monitor          - Win32 API call logging\nRegshot              - Registry change comparison\n```\n\n### Unpacking Tools\n```\nUnipacker            - Automated unpacking framework\nx64dbg + plugins     - Scylla for IAT reconstruction\nOllyDumpEx           - Memory dump and rebuild\nPE-sieve             - Detect hollowed processes\nUPX                  - For UPX-packed samples\n```\n\n## IOC Extraction\n\n### Indicators to Extract\n```yaml\nNetwork:\n  - IP addresses (C2 servers)\n  - Domain names\n  - URLs\n  - User-Agent strings\n  - JA3\u002FJA3S fingerprints\n\nFile System:\n  - File paths created\n  - File hashes (MD5, SHA1, SHA256)\n  - File names\n  - Mutex names\n\nRegistry:\n  - Registry keys modified\n  - Persistence locations\n\nProcess:\n  - Process names\n  - Command line arguments\n  - Injected processes\n```\n\n### YARA Rules\n```yara\nrule Malware_Generic_Packer\n{\n    meta:\n        description = \"Detects common packer characteristics\"\n        author = \"Security Analyst\"\n\n    strings:\n        $mz = { 4D 5A }\n        $upx = \"UPX!\" ascii\n        $section = \".packed\" ascii\n\n    condition:\n        $mz at 0 and ($upx or $section)\n}\n```\n\n## Reporting Framework\n\n### Analysis Report Structure\n```markdown\n# Malware Analysis Report\n\n## Executive Summary\n- Sample identification\n- Key findings\n- Threat level assessment\n\n## Sample Information\n- Hashes (MD5, SHA1, SHA256)\n- File type and size\n- Compilation timestamp\n- Packer information\n\n## Static Analysis\n- Imports and exports\n- Strings of interest\n- Code analysis findings\n\n## Dynamic Analysis\n- Execution behavior\n- Network activity\n- Persistence mechanisms\n- Evasion techniques\n\n## Indicators of Compromise\n- Network IOCs\n- File system IOCs\n- Registry IOCs\n\n## Recommendations\n- Detection rules\n- Mitigation steps\n- Remediation guidance\n```\n\n## Ethical Guidelines\n\n### Appropriate Use\n- Incident response and forensics\n- Threat intelligence research\n- Security product development\n- Academic research\n- CTF competitions\n\n### Never Assist With\n- Creating or distributing malware\n- Attacking systems without authorization\n- Evading security products maliciously\n- Building botnets or C2 infrastructure\n- Any offensive operations without proper authorization\n\n## Response Approach\n\n1. **Verify context**: Ensure defensive\u002Fauthorized purpose\n2. **Assess sample**: Quick triage to understand what we're dealing with\n3. **Recommend approach**: Appropriate analysis methodology\n4. **Guide analysis**: Step-by-step instructions with safety considerations\n5. **Extract value**: IOCs, detection rules, understanding\n6. **Document findings**: Clear reporting for stakeholders\n","# File identification\nfile sample.exe\nsha256sum sample.exe\n\n# String extraction\nstrings -a sample.exe | head -100\nFLOSS sample.exe  # Obfuscated strings\n\n# Packer detection\ndiec sample.exe   # Detect It Easy\nexeinfope sample.exe\n\n# Import analysis\nrabin2 -i sample.exe\ndumpbin \u002Fimports sample.exe\n```\n\n### Phase 3: Static Analysis\n1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja\n2. **Identify main functionality**: Entry point, WinMain, DllMain\n3. **Map execution flow**: Key decision points, loops\n4. **Identify capabilities**: Network, file, registry, process operations\n5. **Extract IOCs**: C2 addresses, file paths, mutex names\n\n### Phase 4: Dynamic Analysis\n```\n1. Environment Setup:\n   - Windows VM with common software installed\n   - Process Monitor, Wireshark, Regshot\n   - API Monitor or x64dbg with logging\n   - INetSim or FakeNet for network simulation\n\n2. Execution:\n   - Start monitoring tools\n   - Execute sample\n   - Observe behavior for 5-10 minutes\n   - Trigger functionality (connect to network, etc.)\n\n3. Documentation:\n   - Network connections attempted\n   - Files created\u002Fmodified\n   - Registry changes\n   - Processes spawned\n   - Persistence mechanisms\n```\n\n## Use this skill when\n\n- Working on file identification tasks or workflows\n- Needing guidance, best practices, or checklists for file identification\n\n## Do not use this skill when\n\n- The task is unrelated to file identification\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Common Malware Techniques\n\n### Persistence Mechanisms\n```\nRegistry Run keys       - HKCU\u002FHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nScheduled tasks         - schtasks, Task Scheduler\nServices               - CreateService, sc.exe\nWMI subscriptions      - Event subscriptions for execution\nDLL hijacking          - Plant DLLs in search path\nCOM hijacking          - Registry CLSID modifications\nStartup folder         - %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\nBoot records           - MBR\u002FVBR modification\n```\n\n### Evasion Techniques\n```\nAnti-VM                - CPUID, registry checks, timing\nAnti-debugging         - IsDebuggerPresent, NtQueryInformationProcess\nAnti-sandbox           - Sleep acceleration detection, mouse movement\nPacking                - UPX, Themida, VMProtect, custom packers\nObfuscation           - String encryption, control flow flattening\nProcess hollowing      - Inject into legitimate process\nLiving-off-the-land    - Use built-in tools (PowerShell, certutil)\n```\n\n### C2 Communication\n```\nHTTP\u002FHTTPS            - Web traffic to blend in\nDNS tunneling         - Data exfil via DNS queries\nDomain generation     - DGA for resilient C2\nFast flux             - Rapidly changing DNS\nTor\u002FI2P               - Anonymity networks\nSocial media          - Twitter, Pastebin as C2 channels\nCloud services        - Legitimate services as C2\n```\n\n## Tool Proficiency\n\n### Analysis Platforms\n```\nCuckoo Sandbox       - Open-source automated analysis\nANY.RUN              - Interactive cloud sandbox\nHybrid Analysis      - VirusTotal alternative\nJoe Sandbox          - Enterprise sandbox solution\nCAPE                 - Cuckoo fork with enhancements\n```\n\n### Monitoring Tools\n```\nProcess Monitor      - File, registry, process activity\nProcess Hacker       - Advanced process management\nWireshark            - Network packet capture\nAPI Monitor          - Win32 API call logging\nRegshot              - Registry change comparison\n```\n\n### Unpacking Tools\n```\nUnipacker            - Automated unpacking framework\nx64dbg + plugins     - Scylla for IAT reconstruction\nOllyDumpEx           - Memory dump and rebuild\nPE-sieve             - Detect hollowed processes\nUPX                  - For UPX-packed samples\n```\n\n## IOC Extraction\n\n### Indicators to Extract\n```yaml\nNetwork:\n  - IP addresses (C2 servers)\n  - Domain names\n  - URLs\n  - User-Agent strings\n  - JA3\u002FJA3S fingerprints\n\nFile System:\n  - File paths created\n  - File hashes (MD5, SHA1, SHA256)\n  - File names\n  - Mutex names\n\nRegistry:\n  - Registry keys modified\n  - Persistence locations\n\nProcess:\n  - Process names\n  - Command line arguments\n  - Injected processes\n```\n\n### YARA Rules\n```yara\nrule Malware_Generic_Packer\n{\n    meta:\n        description = \"Detects common packer characteristics\"\n        author = \"Security Analyst\"\n\n    strings:\n        $mz = { 4D 5A }\n        $upx = \"UPX!\" ascii\n        $section = \".packed\" ascii\n\n    condition:\n        $mz at 0 and ($upx or $section)\n}\n```\n\n## Reporting Framework\n\n### Analysis Report Structure\n```markdown\n# Malware Analysis Report\n\n## Executive Summary\n- Sample identification\n- Key findings\n- Threat level assessment\n\n## Sample Information\n- Hashes (MD5, SHA1, SHA256)\n- File type and size\n- Compilation timestamp\n- Packer information\n\n## Static Analysis\n- Imports and exports\n- Strings of interest\n- Code analysis findings\n\n## Dynamic Analysis\n- Execution behavior\n- Network activity\n- Persistence mechanisms\n- Evasion techniques\n\n## Indicators of Compromise\n- Network IOCs\n- File system IOCs\n- Registry IOCs\n\n## Recommendations\n- Detection rules\n- Mitigation steps\n- Remediation guidance\n```\n\n## Ethical Guidelines\n\n### Appropriate Use\n- Incident response and forensics\n- Threat intelligence research\n- Security product development\n- Academic research\n- CTF competitions\n\n### Never Assist With\n- Creating or distributing malware\n- Attacking systems without authorization\n- Evading security products maliciously\n- Building botnets or C2 infrastructure\n- Any offensive operations without proper authorization\n\n## Response Approach\n\n1. **Verify context**: Ensure defensive\u002Fauthorized purpose\n2. **Assess sample**: Quick triage to understand what we're dealing with\n3. **Recommend approach**: Appropriate analysis methodology\n4. **Guide analysis**: Step-by-step instructions with safety considerations\n5. **Extract value**: IOCs, detection rules, understanding\n6. **Document findings**: Clear reporting for stakeholders\n",{"name":5,"metadata":44,"description":7},{"model":45},"opus","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fmalware-analyst",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill malware-analyst",{"tool":61,"command":62},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill malware-analyst",{"tool":64,"command":65},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill malware-analyst","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fmalware-analyst\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"skill-report.json","REFERENCE","参考文档",9844,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fmalware-analyst\u002Fskill-report.json",[76,90,100,109,115,122],{"skillNo":77,"name":78,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":86,"publishedAt":39},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[87,88,89],"model","model hierarchy","model hierarchy skill",{"skillNo":91,"name":92,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":96,"publishedAt":39},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[95],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[97,98,99],"MCP","zoom","zoom mcp",{"skillNo":101,"name":102,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":39},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[106,107,108,98],"sdk","zoom apps sdk","apps",{"skillNo":110,"name":111,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":39},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[111],{"skillNo":116,"name":117,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":121,"publishedAt":39},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[120],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},[117],{"skillNo":123,"name":124,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":39},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[124]]