[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7B985PBY5345FXR891Y2S19":3,"skill-same:01M7B985PBY5345FXR891Y2S19":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":15,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":13,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":75,"install":76,"resources":89},"01M7B985PBY5345FXR891Y2S19","reverse-engineering-ransomware-encryption-routine",null,"Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.","vikasvardhanv\u002Fjerry_skills","vikasvardhanv","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F99010657?v=4","01M7B2B0VN78W7529RQX5BR6DZ","01M7B2B0WDNTXJHRK3QNPNWRP6",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: reverse-engineering-ransomware-encryption-routine\ndescription: Reverse engineer ransomware encryption routines to identify cryptographic\n  algorithms, key generation flaws, and potential decryption opportunities using static\n  and dynamic analysis.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- ransomware\n- encryption\n- reverse-engineering\n- cryptanalysis\n- aes\n- rsa\n- decryption\n- malware-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\n- Platform Hardening\n- File Format Verification\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T1486\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - monetization\n  - positioning\n  techniques:\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n---\n# Reverse Engineering Ransomware Encryption Routine\n\n## Overview\n\nModern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC\u002FCTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048\u002F4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA).\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering ransomware encryption routine\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro or Ghidra for static disassembly\n- x64dbg\u002FWinDbg for dynamic debugging\n- Python 3.9+ with `pycryptodome`, `pefile`\n- Understanding of AES, RSA, ChaCha20, Curve25519 algorithms\n- Knowledge of Windows CryptoAPI and CNG (BCrypt) functions\n- Sandbox environment for safe execution\n\n## Key Concepts\n\n### Hybrid Encryption Model\n\nRansomware generates a unique AES key and IV for each file. The file content is encrypted with this symmetric key. The symmetric key is then encrypted with the attacker's RSA public key (embedded in the binary or fetched from C2). The encrypted key is appended or prepended to the encrypted file. Only the attacker holding the RSA private key can decrypt the per-file symmetric keys.\n\n### Cryptographic API Identification\n\nWindows ransomware typically uses CryptoAPI (`CryptAcquireContext`, `CryptGenKey`, `CryptEncrypt`) or CNG (`BCryptGenerateSymmetricKey`, `BCryptEncrypt`). Some use OpenSSL or custom implementations. Identifying these API calls provides immediate insight into the algorithm, key size, and mode of operation.\n\n### Implementation Flaws\n\nDecryption opportunities arise from: hardcoded encryption keys, weak PRNG for key generation (using `GetTickCount` or `time()` as seed), reuse of IVs across files, ECB mode usage, keys remaining in memory post-encryption, and race conditions where keys can be captured during encryption.\n\n## Workflow\n\n### Step 1: Identify Cryptographic Functions\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify cryptographic functions in ransomware PE files.\"\"\"\nimport pefile\nimport sys\n\nCRYPTO_APIS = {\n    # Windows CryptoAPI\n    \"CryptAcquireContextA\": \"CryptoAPI context acquisition\",\n    \"CryptAcquireContextW\": \"CryptoAPI context acquisition\",\n    \"CryptGenKey\": \"Key generation\",\n    \"CryptDeriveKey\": \"Key derivation\",\n    \"CryptEncrypt\": \"Encryption operation\",\n    \"CryptDecrypt\": \"Decryption operation\",\n    \"CryptImportKey\": \"Key import (public key?)\",\n    \"CryptExportKey\": \"Key export\",\n    \"CryptGenRandom\": \"Random number generation\",\n    \"CryptCreateHash\": \"Hash creation\",\n    \"CryptHashData\": \"Hashing operation\",\n    # Windows CNG (BCrypt)\n    \"BCryptOpenAlgorithmProvider\": \"CNG algorithm initialization\",\n    \"BCryptGenerateSymmetricKey\": \"CNG symmetric key generation\",\n    \"BCryptEncrypt\": \"CNG encryption\",\n    \"BCryptDecrypt\": \"CNG decryption\",\n    \"BCryptGenerateKeyPair\": \"CNG key pair generation\",\n    \"BCryptImportKeyPair\": \"CNG key import\",\n    # OpenSSL\n    \"EVP_EncryptInit_ex\": \"OpenSSL encrypt init\",\n    \"EVP_EncryptUpdate\": \"OpenSSL encrypt update\",\n    \"EVP_EncryptFinal_ex\": \"OpenSSL encrypt final\",\n    \"RSA_public_encrypt\": \"OpenSSL RSA encryption\",\n    \"AES_set_encrypt_key\": \"OpenSSL AES key setup\",\n    # File operations\n    \"CreateFileW\": \"File open (target files)\",\n    \"ReadFile\": \"File read (before encryption)\",\n    \"WriteFile\": \"File write (after encryption)\",\n    \"FindFirstFileW\": \"File enumeration (targeting)\",\n    \"FindNextFileW\": \"File enumeration\",\n    \"MoveFileW\": \"File rename (extension change)\",\n    \"DeleteFileW\": \"File deletion (originals)\",\n}\n\nAES_SBOX = bytes([\n    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,\n    0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,\n])\n\nCHACHA20_CONSTANT = b\"expand 32-byte k\"\n\n\ndef analyze_imports(filepath):\n    \"\"\"Analyze PE imports for cryptographic APIs.\"\"\"\n    try:\n        pe = pefile.PE(filepath)\n    except pefile.PEFormatError:\n        print(\"[-] Not a valid PE file\")\n        return\n\n    print(\"[+] Cryptographic API Analysis\")\n    print(\"=\" * 60)\n\n    crypto_imports = []\n    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in pe.DIRECTORY_ENTRY_IMPORT:\n            dll = entry.dll.decode('utf-8', errors='replace')\n            for imp in entry.imports:\n                if imp.name:\n                    name = imp.name.decode('utf-8', errors='replace')\n                    if name in CRYPTO_APIS:\n                        desc = CRYPTO_APIS[name]\n                        crypto_imports.append((dll, name, desc))\n                        print(f\"  [{dll}] {name}: {desc}\")\n\n    if not crypto_imports:\n        print(\"  No known crypto APIs found in imports\")\n        print(\"  Malware may use custom implementation or dynamic loading\")\n\n    return crypto_imports\n\n\ndef find_crypto_constants(filepath):\n    \"\"\"Search for embedded cryptographic constants.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(\"\\n[+] Cryptographic Constants Search\")\n    print(\"=\" * 60)\n\n    # AES S-Box\n    offset = data.find(AES_SBOX)\n    if offset != -1:\n        print(f\"  AES S-Box found at offset 0x{offset:x}\")\n\n    # ChaCha20\u002FSalsa20 constant\n    offset = data.find(CHACHA20_CONSTANT)\n    if offset != -1:\n        print(f\"  ChaCha20 constant at offset 0x{offset:x}\")\n\n    # RSA public key markers\n    rsa_markers = [\n        b'-----BEGIN PUBLIC KEY-----',\n        b'-----BEGIN RSA PUBLIC KEY-----',\n        b'\\x30\\x82',  # ASN.1 SEQUENCE\n    ]\n    for marker in rsa_markers:\n        offset = data.find(marker)\n        if offset != -1:\n            print(f\"  RSA key marker at offset 0x{offset:x}\")\n\n    # Common ransomware file extension patterns\n    import re\n    ext_pattern = re.compile(rb'\\.\\w{3,10}(?=\\x00)', re.IGNORECASE)\n    extensions = set()\n    for match in ext_pattern.finditer(data):\n        ext = match.group().decode('ascii', errors='replace').lower()\n        target_exts = [\n            '.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt',\n            '.jpg', '.png', '.sql', '.mdb', '.bak', '.zip',\n        ]\n        if ext in target_exts:\n            extensions.add(ext)\n\n    if extensions:\n        print(f\"\\n  Target file extensions: {', '.join(sorted(extensions))}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cransomware_sample>\")\n        sys.exit(1)\n\n    analyze_imports(sys.argv[1])\n    find_crypto_constants(sys.argv[1])\n```\n\n### Step 2: Analyze Encryption Flow\n\n```python\ndef analyze_encryption_pattern(filepath):\n    \"\"\"Analyze file encryption patterns from ransomware artifacts.\"\"\"\n    import os\n    import struct\n\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    file_size = len(data)\n    print(f\"\\n[+] Encrypted File Analysis: {filepath}\")\n    print(f\"  Size: {file_size:,} bytes\")\n\n    # Check for appended key material (common pattern)\n    # Many ransomware families append encrypted key at end of file\n    tail_sizes = [256, 512, 1024, 2048]  # Common RSA ciphertext sizes\n    for size in tail_sizes:\n        if file_size > size + 16:\n            tail = data[-size:]\n            # High entropy suggests encrypted data\n            entropy = calculate_entropy(tail)\n            if entropy > 7.5:\n                print(f\"  Possible encrypted key ({size} bytes) \"\n                      f\"at end of file (entropy: {entropy:.2f})\")\n\n    # Check for header modifications\n    # Many ransomware prepend metadata\n    header = data[:64]\n    print(f\"  First 16 bytes: {header[:16].hex()}\")\n\n    # Check if original file header is preserved\n    known_headers = {\n        b'PK': 'ZIP\u002FOffice',\n        b'\\x89PNG': 'PNG',\n        b'\\xff\\xd8\\xff': 'JPEG',\n        b'%PDF': 'PDF',\n        b'\\xd0\\xcf\\x11\\xe0': 'OLE (DOC\u002FXLS)',\n    }\n    for magic, ftype in known_headers.items():\n        if header.startswith(magic):\n            print(f\"  Original format preserved: {ftype}\")\n            break\n    else:\n        print(\"  Original header destroyed\u002Fencrypted\")\n\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data.\"\"\"\n    from collections import Counter\n    import math\n\n    if not data:\n        return 0\n\n    freq = Counter(data)\n    length = len(data)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in freq.values()\n    )\n    return entropy\n```\n\n## Validation Criteria\n\n- Cryptographic algorithms identified (AES, RSA, ChaCha20, etc.)\n- Key size and mode of operation determined\n- Key generation method analyzed for potential weaknesses\n- Per-file key encryption scheme documented\n- File targeting patterns and extension list extracted\n- Embedded public keys extracted for infrastructure correlation\n- Potential decryption opportunities assessed\n\n## References\n\n- [Morphisec - Breaking Down Ransomware Encryption](https:\u002F\u002Fwww.morphisec.com\u002Fblog\u002Fbreaking-down-ransomware-encryption-key-strategies-algorithms-and-implementation-trends\u002F)\n- [Emsisoft - Ransomware Encryption Methods](https:\u002F\u002Fwww.emsisoft.com\u002Fen\u002Fblog\u002F27649\u002Fransomware-encryption-methods\u002F)\n- [Halcyon Ransomware Power Rankings Q4-2024](https:\u002F\u002Fwww.halcyon.ai\u002Fraas-mq\u002Fpower-rankings-ransomware-malicious-quartile-q4-2024)\n- [No More Ransom Project](https:\u002F\u002Fwww.nomoreransom.org\u002F)\n- [MITRE ATT&CK T1486 - Data Encrypted for Impact](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F)\n","# Reverse Engineering Ransomware Encryption Routine\n\n## Overview\n\nModern ransomware uses hybrid encryption combining symmetric algorithms (AES-256-CBC\u002FCTR, ChaCha20, Salsa20) for file encryption with asymmetric algorithms (RSA-2048\u002F4096, Curve25519) for key protection. The encryption routine typically generates a random symmetric key per file, encrypts file contents, then encrypts the symmetric key with the attacker's embedded public key. Reverse engineering these routines identifies the specific algorithms, key derivation methods, initialization vectors, file targeting patterns, and potential implementation flaws that could enable decryption without paying the ransom. Notable examples include Rhysida (AES-256-CTR + RSA-4096), Qilin.B (AES-256-CTR with AES-NI or ChaCha20 fallback), and Medusa (AES-256 + RSA).\n\n\n## When to Use\n\n- When performing authorized security testing that involves reverse engineering ransomware encryption routine\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- IDA Pro or Ghidra for static disassembly\n- x64dbg\u002FWinDbg for dynamic debugging\n- Python 3.9+ with `pycryptodome`, `pefile`\n- Understanding of AES, RSA, ChaCha20, Curve25519 algorithms\n- Knowledge of Windows CryptoAPI and CNG (BCrypt) functions\n- Sandbox environment for safe execution\n\n## Key Concepts\n\n### Hybrid Encryption Model\n\nRansomware generates a unique AES key and IV for each file. The file content is encrypted with this symmetric key. The symmetric key is then encrypted with the attacker's RSA public key (embedded in the binary or fetched from C2). The encrypted key is appended or prepended to the encrypted file. Only the attacker holding the RSA private key can decrypt the per-file symmetric keys.\n\n### Cryptographic API Identification\n\nWindows ransomware typically uses CryptoAPI (`CryptAcquireContext`, `CryptGenKey`, `CryptEncrypt`) or CNG (`BCryptGenerateSymmetricKey`, `BCryptEncrypt`). Some use OpenSSL or custom implementations. Identifying these API calls provides immediate insight into the algorithm, key size, and mode of operation.\n\n### Implementation Flaws\n\nDecryption opportunities arise from: hardcoded encryption keys, weak PRNG for key generation (using `GetTickCount` or `time()` as seed), reuse of IVs across files, ECB mode usage, keys remaining in memory post-encryption, and race conditions where keys can be captured during encryption.\n\n## Workflow\n\n### Step 1: Identify Cryptographic Functions\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify cryptographic functions in ransomware PE files.\"\"\"\nimport pefile\nimport sys\n\nCRYPTO_APIS = {\n    # Windows CryptoAPI\n    \"CryptAcquireContextA\": \"CryptoAPI context acquisition\",\n    \"CryptAcquireContextW\": \"CryptoAPI context acquisition\",\n    \"CryptGenKey\": \"Key generation\",\n    \"CryptDeriveKey\": \"Key derivation\",\n    \"CryptEncrypt\": \"Encryption operation\",\n    \"CryptDecrypt\": \"Decryption operation\",\n    \"CryptImportKey\": \"Key import (public key?)\",\n    \"CryptExportKey\": \"Key export\",\n    \"CryptGenRandom\": \"Random number generation\",\n    \"CryptCreateHash\": \"Hash creation\",\n    \"CryptHashData\": \"Hashing operation\",\n    # Windows CNG (BCrypt)\n    \"BCryptOpenAlgorithmProvider\": \"CNG algorithm initialization\",\n    \"BCryptGenerateSymmetricKey\": \"CNG symmetric key generation\",\n    \"BCryptEncrypt\": \"CNG encryption\",\n    \"BCryptDecrypt\": \"CNG decryption\",\n    \"BCryptGenerateKeyPair\": \"CNG key pair generation\",\n    \"BCryptImportKeyPair\": \"CNG key import\",\n    # OpenSSL\n    \"EVP_EncryptInit_ex\": \"OpenSSL encrypt init\",\n    \"EVP_EncryptUpdate\": \"OpenSSL encrypt update\",\n    \"EVP_EncryptFinal_ex\": \"OpenSSL encrypt final\",\n    \"RSA_public_encrypt\": \"OpenSSL RSA encryption\",\n    \"AES_set_encrypt_key\": \"OpenSSL AES key setup\",\n    # File operations\n    \"CreateFileW\": \"File open (target files)\",\n    \"ReadFile\": \"File read (before encryption)\",\n    \"WriteFile\": \"File write (after encryption)\",\n    \"FindFirstFileW\": \"File enumeration (targeting)\",\n    \"FindNextFileW\": \"File enumeration\",\n    \"MoveFileW\": \"File rename (extension change)\",\n    \"DeleteFileW\": \"File deletion (originals)\",\n}\n\nAES_SBOX = bytes([\n    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,\n    0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,\n])\n\nCHACHA20_CONSTANT = b\"expand 32-byte k\"\n\n\ndef analyze_imports(filepath):\n    \"\"\"Analyze PE imports for cryptographic APIs.\"\"\"\n    try:\n        pe = pefile.PE(filepath)\n    except pefile.PEFormatError:\n        print(\"[-] Not a valid PE file\")\n        return\n\n    print(\"[+] Cryptographic API Analysis\")\n    print(\"=\" * 60)\n\n    crypto_imports = []\n    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in pe.DIRECTORY_ENTRY_IMPORT:\n            dll = entry.dll.decode('utf-8', errors='replace')\n            for imp in entry.imports:\n                if imp.name:\n                    name = imp.name.decode('utf-8', errors='replace')\n                    if name in CRYPTO_APIS:\n                        desc = CRYPTO_APIS[name]\n                        crypto_imports.append((dll, name, desc))\n                        print(f\"  [{dll}] {name}: {desc}\")\n\n    if not crypto_imports:\n        print(\"  No known crypto APIs found in imports\")\n        print(\"  Malware may use custom implementation or dynamic loading\")\n\n    return crypto_imports\n\n\ndef find_crypto_constants(filepath):\n    \"\"\"Search for embedded cryptographic constants.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    print(\"\\n[+] Cryptographic Constants Search\")\n    print(\"=\" * 60)\n\n    # AES S-Box\n    offset = data.find(AES_SBOX)\n    if offset != -1:\n        print(f\"  AES S-Box found at offset 0x{offset:x}\")\n\n    # ChaCha20\u002FSalsa20 constant\n    offset = data.find(CHACHA20_CONSTANT)\n    if offset != -1:\n        print(f\"  ChaCha20 constant at offset 0x{offset:x}\")\n\n    # RSA public key markers\n    rsa_markers = [\n        b'-----BEGIN PUBLIC KEY-----',\n        b'-----BEGIN RSA PUBLIC KEY-----',\n        b'\\x30\\x82',  # ASN.1 SEQUENCE\n    ]\n    for marker in rsa_markers:\n        offset = data.find(marker)\n        if offset != -1:\n            print(f\"  RSA key marker at offset 0x{offset:x}\")\n\n    # Common ransomware file extension patterns\n    import re\n    ext_pattern = re.compile(rb'\\.\\w{3,10}(?=\\x00)', re.IGNORECASE)\n    extensions = set()\n    for match in ext_pattern.finditer(data):\n        ext = match.group().decode('ascii', errors='replace').lower()\n        target_exts = [\n            '.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt',\n            '.jpg', '.png', '.sql', '.mdb', '.bak', '.zip',\n        ]\n        if ext in target_exts:\n            extensions.add(ext)\n\n    if extensions:\n        print(f\"\\n  Target file extensions: {', '.join(sorted(extensions))}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cransomware_sample>\")\n        sys.exit(1)\n\n    analyze_imports(sys.argv[1])\n    find_crypto_constants(sys.argv[1])\n```\n\n### Step 2: Analyze Encryption Flow\n\n```python\ndef analyze_encryption_pattern(filepath):\n    \"\"\"Analyze file encryption patterns from ransomware artifacts.\"\"\"\n    import os\n    import struct\n\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    file_size = len(data)\n    print(f\"\\n[+] Encrypted File Analysis: {filepath}\")\n    print(f\"  Size: {file_size:,} bytes\")\n\n    # Check for appended key material (common pattern)\n    # Many ransomware families append encrypted key at end of file\n    tail_sizes = [256, 512, 1024, 2048]  # Common RSA ciphertext sizes\n    for size in tail_sizes:\n        if file_size > size + 16:\n            tail = data[-size:]\n            # High entropy suggests encrypted data\n            entropy = calculate_entropy(tail)\n            if entropy > 7.5:\n                print(f\"  Possible encrypted key ({size} bytes) \"\n                      f\"at end of file (entropy: {entropy:.2f})\")\n\n    # Check for header modifications\n    # Many ransomware prepend metadata\n    header = data[:64]\n    print(f\"  First 16 bytes: {header[:16].hex()}\")\n\n    # Check if original file header is preserved\n    known_headers = {\n        b'PK': 'ZIP\u002FOffice',\n        b'\\x89PNG': 'PNG',\n        b'\\xff\\xd8\\xff': 'JPEG',\n        b'%PDF': 'PDF',\n        b'\\xd0\\xcf\\x11\\xe0': 'OLE (DOC\u002FXLS)',\n    }\n    for magic, ftype in known_headers.items():\n        if header.startswith(magic):\n            print(f\"  Original format preserved: {ftype}\")\n            break\n    else:\n        print(\"  Original header destroyed\u002Fencrypted\")\n\n\ndef calculate_entropy(data):\n    \"\"\"Calculate Shannon entropy of data.\"\"\"\n    from collections import Counter\n    import math\n\n    if not data:\n        return 0\n\n    freq = Counter(data)\n    length = len(data)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in freq.values()\n    )\n    return entropy\n```\n\n## Validation Criteria\n\n- Cryptographic algorithms identified (AES, RSA, ChaCha20, etc.)\n- Key size and mode of operation determined\n- Key generation method analyzed for potential weaknesses\n- Per-file key encryption scheme documented\n- File targeting patterns and extension list extracted\n- Embedded public keys extracted for infrastructure correlation\n- Potential decryption opportunities assessed\n\n## References\n\n- [Morphisec - Breaking Down Ransomware Encryption](https:\u002F\u002Fwww.morphisec.com\u002Fblog\u002Fbreaking-down-ransomware-encryption-key-strategies-algorithms-and-implementation-trends\u002F)\n- [Emsisoft - Ransomware Encryption Methods](https:\u002F\u002Fwww.emsisoft.com\u002Fen\u002Fblog\u002F27649\u002Fransomware-encryption-methods\u002F)\n- [Halcyon Ransomware Power Rankings Q4-2024](https:\u002F\u002Fwww.halcyon.ai\u002Fraas-mq\u002Fpower-rankings-ransomware-malicious-quartile-q4-2024)\n- [No More Ransom Project](https:\u002F\u002Fwww.nomoreransom.org\u002F)\n- [MITRE ATT&CK T1486 - Data Encrypted for Impact](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F)\n",{"name":5,"tags":24,"author":33,"domain":34,"license":14,"version":35,"mitre_f3":36,"nist_csf":53,"subdomain":32,"description":7,"mitre_attack":58,"d3fend_techniques":64},[25,26,27,28,29,30,31,32],"ransomware","encryption","reverse-engineering","cryptanalysis","aes","rsa","decryption","malware-analysis","mahipal","cybersecurity","1.0",{"tactics":37,"version":40,"techniques":41},[38,39],"monetization","positioning","1.1",[42,46,49],{"id":43,"name":44,"source":45,"tactic":38},"F1018","Convert to Cryptocurrency","f3",{"id":47,"name":48,"source":45,"tactic":38},"F1047","Transfer of funds",{"id":50,"name":51,"source":52,"tactic":39},"T1219","Remote Access Tools","attack",[54,55,56,57],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[59,60,61,62,63],"T1027","T1055","T1140","T1497","T1486",[65,66,67,68,69],"File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification","main","1eb986d0b0ecc180291597e08eb5a58288843536","skills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv","2026-08-25 13:16:33",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add vikasvardhanv\u002Fjerry_skills --skill reverse-engineering-ransomware-encryption-routine",{"tool":82,"command":83},"bunx","bunx skills add vikasvardhanv\u002Fjerry_skills --skill reverse-engineering-ransomware-encryption-routine",{"tool":85,"command":86},"pnpm","pnpm dlx skills add vikasvardhanv\u002Fjerry_skills --skill reverse-engineering-ransomware-encryption-routine","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002FSKILL.md",true,[90,96,100,106,110,114,120],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",849,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":15},"LICENSE","许可证",11255,{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1902,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",1168,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",1698,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",6767,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",5561,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Freverse-engineering-ransomware-encryption-routine\u002Fscripts\u002Fprocess.py",[125,133,140,147,154,161],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":19},"01M7BESR1CJ3H5SP9XM8KYJZ9W","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","MIT","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[],[],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":19},"01M7BES1YA6R97W7QPMFFM1PED","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[],[],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":19},"01M7BERNHYGY035AR00VRT03KE","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[],[],{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":19},"01M7BERCK1EAKTWW7R436WAR0J","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[],[],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":19},"01M7BEQZAZAQRTXFJRY7RHV3TY","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[],[],{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":19},"01M7BEQKJ45K31QK5VRAQSVJCJ","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[],[]]