102건 · 관련도순
Use when characterising a malware sample, the user asks "what does this binary do?" / "analyse this hash deeply", or `/hash-investigation` flags a novel sample warranting deeper review. Static + dynamic methodology, behavioural indicators, sandbox interpretation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform static reverse engineering and analysis on Windows Portable Executable (PE) files to identify malicious indicators without executing the file. Use this skill during Incident Response, malware triage, or threat hunting to safely extract metadata, imported APIs, exported functions, embedded strings, and packed indicators from suspicious Windows binaries (.exe, .dll, .sys).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Builds a safe, isolated environment for detonating and analyzing malware using virtualization, host-only or simulated networking, and snapshotting. Activates for requests about creating a malware lab, sandbox VM, isolated analysis environment, or safe detonation setup.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Extracts ASCII and Unicode strings from a binary and classifies them into investigative categories: URLs, IPs, file paths, registry keys, mutexes, commands, and API names, prioritizing the analyst's attention. Activates for requests to extract strings, classify strings output, or pull human-readable artifacts from a sample.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from a process memory dump by locating decrypted config structures and decoding common obfuscation layers. Activates for requests to extract malware config from a memory dump, recover C2 settings from a running sample, or decode an in-memory configuration block.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects packing and encryption by measuring Shannon entropy across a binary's sections and regions: flagging high-entropy executable sections, entropy spikes, and size/raw-vs-virtual anomalies that indicate compression or encryption. Activates for requests to measure entropy, detect packing, or assess whether a sample is compressed/encrypted.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Summarizes runtime behavior of a sample from Procmon-style operation logs — process and thread creation, file and registry writes, and network-related operations — to build a behavioral profile. Activates for requests to analyze Procmon output, summarize sample behavior, or profile process/file/registry activity from a sandbox run.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Carves injected PE images and position-independent shellcode from a memory dump or carved region, identifies the payload type, and prepares it for disassembly or emulation. Activates for requests to recover injected code, carve shellcode from memory, or reconstruct a dumped payload for analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/ UEFI), kernel-mode components, and stealth hooking techniques from static indicators. Activates for requests to analyze a bootkit or rootkit, examine MBR/UEFI tampering, or identify kernel-mode stealth components.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes infostealer samples by mapping the browser, credential store, wallet, and application paths they target, and the exfiltration channel used, from static strings and behavior. Activates for requests to analyze an infostealer, identify targeted credential stores, or map stealer collection and exfiltration behavior.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.