Claude 操作恶意软件分析技能包——涵盖分流、动态分析、检测工程和报告。不涵盖深度静态逆向工程（例如 Ghidra/IDA Pro 反汇编）

💡 想学习这些技能背后的手动分析技巧？ 查看涵盖传统分析方法和工具的全面恶意软件分析标准操作程序。

---

📦 包含内容

1 个编排器 + 5 个子技能 + 主机端脚本，涵盖分流、动态分析、检测工程和报告。技能以 Claude 代码的指令形式编写：Claude 运行静态工具，解析导出的证据，编写和测试规则，并起草报告。你在隔离的虚拟机中执行样本;其他所有工作都由你完成。

• SKILL.md（根）- Orchestrator — 单一入口点，可路由到合适的子技能，管理跨阶段分析状态，并支持多采样批处理工作流程。只需描述你需要什么。

1. 恶意软件分类 - 初步评估与优先级
2. 恶意软件动态分析 - 安全执行与行为监控
3. 专用文件分析器 - 非PE文件分析（.

Malware Analysis Skills Toolkit

Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).

💡 Want to learn the manual analysis techniques behind these skills? Check out the comprehensive Malware Analysis SOP covering traditional analysis methods and tools.

---

📦 What’s Included

1 Orchestrator + 5 Sub-Skills + host-side scripts covering triage, dynamic analysis, detection engineering, and reporting. The skills are written as instructions to Claude Code: Claude runs the static tooling, parses exported evidence, writes and tests the rules, and drafts the report. You execute the sample in your isolated VM; everything else is done for you.

• SKILL.md (root) - Orchestrator — single entry point that routes to the right sub-skill, manages analysis state across phases, and supports multi-sample batch workflows. Just describe what you need.

1. malware-triage - Initial assessment and prioritization
2. malware-dynamic-analysis - Safe execution and behavior monitoring
3. specialized-file-analyzer - Non-PE file analysis (.NET, Office, PDF, scripts, HTA, disk images)
4. detection-engineer - Detection rules and IOC management
5. malware-report-writer - Professional report creation

---

🧠 How It Works (agentic)

These are not tutorials you read — they are instructions Claude Code executes. Claude runs the static tools on the host, parses the evidence you export from the VM, and produces the rules and report. The only manual step is detonating the sample in your isolated VM.

                          YOUR HOST (Claude Code + internet)
  ┌───────────────────────────────────────────────────────────────────────┐
  │  Triage            Claude runs: file · hash_calculator.py · pe_info.py  │
  │                    · strings (ASCII+UTF-16) · ioc_extract.py            │
  │                    → classification, priority, behavior predictions     │
  │                            │                                            │
  │                            ▼  emits a VM runbook tailored to predictions│
  └────────────────────────────┼──────────────────────────────────────────┘
                               │  runbook (filters, export commands)
        ┌──────────────────────▼───────────────────────┐
        │   ISOLATED VM (REMnux / FlareVM, no internet) │   ← you detonate here
        │   snapshot → monitor → execute → 15+ min →    │
        │   export TEXT evidence → revert               │
        └──────────────────────┬───────────────────────┘
                               │  evidence/ (Procmon CSV, Sysmon JSON, tshark, dropped files)
  ┌────────────────────────────▼──────────────────────────────────────────┐