# Analyze suspicious binary files safely

Unknown executables can hide malware behavior that standard scans miss. This skill guides Claude, Codex, or Claude Code through safe static binary analysis and clear threat reporting.

## Install

```bash
npx skillstore add deepbitstechnology/binary-analysis
```

## Metadata

- Status: approved
- Slug: deepbitstechnology-binary-analysis
- Skillstore revision: r1
- Version status: missing
- Tree hash: 17da8c025cb960c25f21ac3e50e260534b924be33ebfd2a7e433c8e7b3b104ec
- Author: DeepBitsTechnology
- GitHub username: DeepBitsTechnology
- License: MIT
- Repository: https://github.com/DeepBitsTechnology/claude-plugins/tree/main/drbinary-chat-plugin/skills/binary-analysis
- Ref: 1ffa7643651792ccb4bd3b15d924d2c97edff755
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 79
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/deepbitstechnology-binary-analysis
- Manifest: https://skillstore.pages.dev/api/skills/deepbitstechnology-binary-analysis/manifest

## Capabilities

- Guides static analysis of Windows executable formats such as EXE, DLL, SYS, and SCR files.
- Structures Ghidra-based review of strings, imports, exports, functions, and PE metadata.
- Helps identify suspicious APIs, persistence indicators, network artifacts, and anti-debugging patterns.
- Produces threat assessment reports with severity, confidence, indicators, and recommended actions.
- Supports defensive classification of suspicious binaries into malware categories when evidence supports it.

## Use Cases

- Triage suspicious attachments: Review an unknown executable from email or chat before deciding whether to quarantine, escalate, or dismiss it.
- Document incident artifacts: Turn a recovered binary from a compromised host into a structured report with indicators and remediation guidance.
- Study malware behavior defensively: Use decompilation, strings, imports, and suspicious API patterns to understand a sample without running it locally.

## Prompt Templates

### Start a basic binary review

```
Analyze the binary at [file_path] using safe static analysis. Summarize file metadata, strings, imports, exports, and any suspicious indicators.
```

### Review suspicious behavior

```
Inspect [binary] for suspicious behaviors such as registry changes, network communication, process injection, persistence, or anti-debugging. Explain the evidence for each behavior.
```

### Extract incident indicators

```
Analyze [binary] and extract useful indicators of compromise, including hashes, domains, IP addresses, mutex names, registry paths, file paths, and notable strings.
```

### Create a full threat report

```
Produce a complete threat assessment for [binary]. Include static analysis findings, decompiled behavior, suspected malware classification, confidence level, evidence, impact, and remediation recommendations.
```

## Limitations

- Requires access to suitable Ghidra or sandbox tools before deep analysis can run.
- Does not safely execute suspicious binaries on the local system.
- Packed, encrypted, or heavily obfuscated binaries may need separate unpacking work.
- Findings depend on available artifacts and should be verified by trained security staff.

## Best Practices

- Analyze suspicious files only in an isolated and authorized environment.
- Record hashes, timestamps, strings, imports, and evidence for repeatable review.
- Separate confirmed behavior from hypotheses and assign a clear confidence level.

## Anti Patterns

- Do not execute an unknown binary on your workstation to see what happens.
- Do not treat a malware family label as confirmed without specific evidence.
- Do not upload sensitive or third-party binaries without authorization.

## Security Audit

- Audited at: 2026-07-09T04:18:19.991\+00:00
- Summary: Static findings are false positives caused by defensive malware-analysis terminology and markdown formatting. The skill is prompt-only guidance for static binary analysis and repeatedly tells users not to execute suspicious files locally. No prompt injection, data exfiltration intent, or executable command behavior was found.

## Stats

- Views: 187
- Downloads: 12
- Favorites: 0
- Popularity score: 0