binary-analysis
Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like "Is [file] malicious?", "Analyze [file]", "What does [binary] do?", or any request involving binary file analysis.
Best use case
binary-analysis is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like "Is [file] malicious?", "Analyze [file]", "What does [binary] do?", or any request involving binary file analysis.
Teams using binary-analysis should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/binary-analysis/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How binary-analysis Compares
| Feature / Agent | binary-analysis | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like "Is [file] malicious?", "Analyze [file]", "What does [binary] do?", or any request involving binary file analysis.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Binary Analysis This skill enables deep analysis of suspicious binary files using remote Ghidra tools and sandbox environments. You HAVE TO upload binary files to the remote first before calling any Ghidra or sandbox tools. ## When to Use This Skill Use this skill when you need to: - Analyze suspicious executable files (.exe, .dll, .sys) - Decompile binaries to understand their behavior - Extract strings, imports, and exports from files - Identify malware capabilities and techniques - Perform static analysis on unknown binaries - Investigate potential trojans, ransomware, or other malware - Generate threat assessment reports ## Workflow ### Step 1: Perform Analysis Use available Ghidra MCP tools to analyze the uploaded binary: - **Decompilation**: Convert assembly to pseudo-C code - **String Analysis**: Extract readable strings for IoC identification - **Import/Export Analysis**: Identify API calls and dependencies - **Function Analysis**: Map out program logic and control flow - **Behavioral Indicators**: Identify suspicious patterns (registry manipulation, network calls, process injection) ### Step 2: Generate Report Provide a comprehensive analysis including: - File metadata (size, hash, compilation timestamp) - Identified capabilities (network, file system, registry, process manipulation) - Suspicious indicators - Malware classification (if applicable) - Recommended actions ## Analysis Techniques ### Static Analysis - PE header examination - Section analysis (.text, .data, .rdata, .rsrc) - Import Address Table (IAT) review - String artifact extraction - Code signature verification ### Behavioral Indicators Look for: - Anti-debugging techniques - Obfuscation/packing - Suspicious API calls (CreateRemoteThread, WriteProcessMemory, etc.) - Network communication patterns - Persistence mechanisms - Privilege escalation attempts ### Malware Classification Common categories: - Trojan/RAT (Remote Access Trojan) - Ransomware - Adware/PUP (Potentially Unwanted Program) - Rootkit - Worm - Spyware - Browser hijacker ## Safety Considerations - **Never execute** the binary on local system - All analysis occurs in remote sandbox environment - Files are automatically isolated - Use Ghidra static analysis tools only - Document all findings for incident response ## Output Format ```markdown ## Binary Analysis Report **File Information** - Name: [filename] - Size: [bytes] - MD5: [hash] - SHA256: [hash] **Analysis Summary** [Brief overview of findings] **Detailed Findings** 1. [Finding category] - Evidence: [specific data] - Significance: [what it means] **Threat Assessment** - Severity: [Critical/High/Medium/Low] - Classification: [malware type] - Confidence: [High/Medium/Low] **Recommendations** 1. [Action item] 2. [Action item] ``` ## Example Usage User: "I found a suspicious file called setup_installer.exe. Can you analyze it?" Response: 1. Run Ghidra analysis on the full local path of setup_installer.exe 2. Extract strings, imports, and decompiled code 3. Identify malicious behavior (if any) 4. Provide detailed report with recommendations
Related Skills
impact-analysis-helper
Impact Analysis Helper - Auto-activating skill for Enterprise Workflows. Triggers on: impact analysis helper, impact analysis helper Part of the Enterprise Workflows skill category.
funnel-analysis-builder
Funnel Analysis Builder - Auto-activating skill for Data Analytics. Triggers on: funnel analysis builder, funnel analysis builder Part of the Data Analytics skill category.
cohort-analysis-creator
Cohort Analysis Creator - Auto-activating skill for Data Analytics. Triggers on: cohort analysis creator, cohort analysis creator Part of the Data Analytics skill category.
churn-analysis-helper
Churn Analysis Helper - Auto-activating skill for Data Analytics. Triggers on: churn analysis helper, churn analysis helper Part of the Data Analytics skill category.
project-workflow-analysis-blueprint-generator
Comprehensive technology-agnostic prompt generator for documenting end-to-end application workflows. Automatically detects project architecture patterns, technology stacks, and data flow patterns to generate detailed implementation blueprints covering entry points, service layers, data access, error handling, and testing approaches across multiple technologies including .NET, Java/Spring, React, and microservices architectures.
datanalysis-credit-risk
Credit risk data cleaning and variable screening pipeline for pre-loan modeling. Use when working with raw credit data that needs quality assessment, missing value analysis, or variable selection before modeling. it covers data loading and formatting, abnormal period filtering, missing rate calculation, high-missing variable removal,low-IV variable filtering, high-PSI variable removal, Null Importance denoising, high-correlation variable removal, and cleaning report generation. Applicable scenarios arecredit risk data cleaning, variable screening, pre-loan modeling preprocessing.
Coverage Analysis
Coverage analysis is essential for understanding which parts of your code are exercised during fuzzing. It helps identify fuzzing blockers like magic value checks and tracks the effectiveness of harness improvements over time.
product-analysis
Multi-path parallel product analysis with cross-model test-time compute scaling. Spawns parallel agents (Claude Code agent teams + Codex CLI) to explore product from multiple perspectives, then synthesizes findings into actionable optimization plans. Can invoke competitors-analysis for competitive benchmarking. Use when "product audit", "self-review", "发布前审查", "产品分析", "analyze our product", "UX audit", or "信息架构审计".
competitors-analysis
Analyze competitor repositories with evidence-based approach. Use when tracking competitors, creating competitor profiles, or generating competitive analysis. CRITICAL - all analysis must be based on actual cloned code, never assumptions. Triggers include "analyze competitor", "add competitor", "competitive analysis", or "竞品分析".
image-analysis
图片分析与识别，可分析本地图片、网络图片、视频、文件。适用于 OCR、物体识别、场景理解等。当用户发送图片或要求分析图片时必须使用此技能。
oss-code-analysis
Explore open-source GitHub repository source trees via web browsing to analyze and compare feature implementations at the code level. Supports two modes: cross-project comparison and single-project deep dive. Use when evaluating how OSS projects implement a specific feature, choosing architecture patterns, or benchmarking implementation strategies.
apify-trend-analysis
Discover and track emerging trends across Google Trends, Instagram, Facebook, YouTube, and TikTok to inform content strategy.