Malware Analysis & Sandboxing

What it does

• Walks through static analysis step by step: file identification, hashing, threat-intel lookups, PE imports, string triage and entropy scoring.
• Ships reference tables of suspicious Windows APIs grouped by injection, persistence, anti-analysis, C2, crypto, credential access and evasion.
• Generates three tiers of YARA rules (hash-specific, family-level, network IOC) with proper meta blocks plus commands to test against benign binaries.
• Interprets Cuckoo/CAPE sandbox reports: process trees, beaconing, registry/file changes, and maps observed behavior to MITRE ATT&CK technique IDs.
• Classifies samples into families (ransomware, RAT, infostealer, cryptominer, dropper) and compares variants using ssdeep fuzzy hashing.
• Provides a hardened lab blueprint: isolated VM, host-only networking, snapshots, INetSim/FakeNet, Regshot, plus anti-anti-VM tuning.
• Outputs a standardized analysis report template with hashes, host/network IOCs and ATT&CK mapping.

Who it's for

• SOC analysts, incident responders and threat hunters
• Blue teamers who write their own YARA/Sigma detections
• Security learners practicing malware triage in isolated labs

Examples

1. "Triage this suspicious EXE: dump imports, strings and section entropy, then tell me how risky it looks."
2. "Build a family-level YARA rule from these three loader samples and give me the false-positive test command."
3. "Here's a CAPE JSON report — summarize behavior, map it to MITRE ATT&CK, and produce the IOC report block."

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/Masriyan/Claude-Code-CyberSecurity-Skill/HEAD/skills/05-malware-analysis/SKILL.md

What I want: (describe your task here)

Install the skill I found on Claude Skill Mart.
Copy the skills/05-malware-analysis folder from the GitHub repo Masriyan/Claude-Code-CyberSecurity-Skill into my ~/.claude/skills/malware-analysis-sandboxing/.
When it's done, tell me in one line what this skill can do.