Skill UI

This skill provides advanced, dual-use security techniques for analyzing protected binaries, including malware and proprietary software. It is strictly intended for authorized security professionals, such as those conducting penetration testing, malware analysis, or academic security research (CTFs). Users must exercise extreme caution, confirm explicit written authorization, and ensure all activities remain within defined legal and ethical scopes to prevent misuse and legal violations.

This skill provides advanced, dual-use security techniques for analyzing protected binaries, including malware and proprietary software. It is strictly intended for authorized security professionals, such as those conducting penetration testing, malware analysis, or academic security research (CTFs). Users must exercise extreme caution, confirm explicit written authorization, and ensure all activities remain within defined legal and ethical scopes to prevent misuse and legal violations.

Memory Forensics Toolkit consolidates guidance for acquiring memory dumps, running Volatility analysis, and following incident response workflows to triage malware and forensic cases.

Static analysis workflow using apktool, jadx, and androguard to decompile Android APK malware, inspect manifests, permissions, APIs, and produce structured IOC/risk reports for SOC investigators.

Analyzes campaign attribution evidence with the Diamond Model and ACH, covering infrastructure overlaps, TTP consistency, malware similarities, timing, and language signals to help SOC analysts and hunters assess threat actor confidence.

Reverse engineer stripped Go malware in Ghidra with GoResolver and Python helpers to recover function metadata, strings, and dependencies while giving SOC analysts actionable steps for threat hunting and detection tuning.

Provides a workflow for investigating malicious Linux ELF binaries, walking through static analysis, dynamic tracing, string detection and reverse-engineering steps so analysts can interrogate botnets, miners, rootkits and other server/container threats.

Analyzes VBA and XLM macro malware hidden in Office documents to reveal download URLs, execution chains, persistence tactics, and anti-analysis tricks for informed incident response.

Runs suspect binaries through Cuckoo Sandbox to capture process creation, file drops, registry edits, network traffic, and API calls, producing detailed behavior reports and IOCs for controlled malware investigations.

Use Sysinternals Autoruns to scan Windows ASEPs, flag unsigned binaries, suspicious paths, and LOLBin launch strings, compare results to clean baselines, and validate persistence indicators for malware hunting and response.

Identifies UPX or similarly packed malware and restores original binaries by combining automated UPX decompression, header repair, and manual debugger unpacking, enabling clearer static analysis in tools like Ghidra or IDA.

Investigate trojanized updates, compromised build artifacts, and sideloaded dependencies to identify intrusion vectors, compare binaries, document code signing anomalies, and extract IOCs for detection rule development.