ctf-malware

The ctf-malware skill is designed to support malware analysis and network traffic investigations specifically within Capture The Flag (CTF) challenge environments. It helps users systematically dissect potentially malicious files, obfuscated scripts, and network communications to uncover hidden behaviors, configurations, or indicators of compromise. By consolidating a wide range of techniques into a single skill, it reduces the overhead of manually gathering tools and reference methods, enabling analysts to focus on identifying malware behavior, detecting anti-analysis mechanisms, and extracting actionable intelligence.

This skill provides a comprehensive suite of capabilities, including static and dynamic analysis of PE and .NET binaries, deobfuscation of JavaScript and PowerShell scripts, identification of junk code patterns, memory forensics using Volatility, shellcode analysis, and the creation or application of YARA rules. It also includes methods for analyzing encrypted communications (RC4, AES), custom command-and-control protocols, and malware network traffic patterns. Anti-analysis techniques such as virtual machine or sandbox detection, API hashing, process injection, and timing evasion are also addressed. Quick start commands and installation instructions for necessary Python packages and Linux/macOS tools are provided to streamline workflow.

Typical users include CTF participants, cybersecurity researchers, malware analysts, and reverse engineers who need to dissect complex malware samples or investigate network-based threats in controlled challenge environments. The skill is particularly useful when tackling obfuscated scripts, encrypted payloads, suspicious binaries, or when performing targeted memory and network forensics. It also serves as a reference for pivoting to related skills like reverse engineering, digital forensics, or OSINT investigations depending on the nature of the challenge.