Binary Analysis

Name: Binary Analysis
Author: aiskillstore

aiskillstore/marketplace

1 installs
404 repo stars
Updated August 5, 2026
aiskillstore/marketplace

binary-analysis is a Claude Code skill that analyzes binary files with remote Ghidra and sandbox tools to detect malware and produce a threat assessment.

About

binary-analysis inspects binary files (exe, dll, sys, bin and similar) to assess whether they are malicious. It uses remote Ghidra and sandbox tools to decompile, extract strings, imports and exports, and identify malware capabilities, then produces a threat assessment report. Analysts use it to investigate suspicious executables without running them locally.

Analyzes binaries to assess whether they are malicious
Decompiles and extracts strings, imports and exports via Ghidra tools
Produces a threat assessment report with severity and classification

Binary Analysis by the numbers

1 all-time installs (skills.sh)
Ranked #1,834 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

At a glance

binary-analysis capabilities & compatibility

Capabilities: binary analysis · malware detection · decompilation · threat assessment
Use cases: security audit

From the docs

What binary-analysis says it does

Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment.

SKILL.md

**Never execute** the binary on local system

SKILL.md

npx skills add https://github.com/aiskillstore/marketplace --skill binary-analysis

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/aiskillstore/marketplace/binary-analysis.svg)](https://skillselion.com/skills/aiskillstore/marketplace/binary-analysis)

Installs	1
repo stars	★ 404
Last updated	August 5, 2026
Repository	aiskillstore/marketplace ↗

What it does

Statically analyze a suspicious binary in a remote sandbox to detect malware and produce a threat assessment report.

Who is it for?

Assessing whether an unknown executable is malicious via static analysis in a sandbox.

Skip if: Running untrusted binaries locally or non-security binary work.

When should I use this skill?

A user asks whether a file is malicious or to analyze a suspicious binary.

What you get

A threat assessment report classifying the binary and its capabilities.

binary analysis report
threat assessment with severity and classification

By the numbers

2-step workflow (analyze, generate report)
7 malware categories listed
4 severity levels (Critical/High/Medium/Low)

Files

SKILL.mdMarkdownGitHub ↗

Binary Analysis

This skill enables deep analysis of suspicious binary files using remote Ghidra tools and sandbox environments. You HAVE TO upload binary files to the remote first before calling any Ghidra or sandbox tools.

When to Use This Skill

Use this skill when you need to:

Analyze suspicious executable files (.exe, .dll, .sys)
Decompile binaries to understand their behavior
Extract strings, imports, and exports from files
Identify malware capabilities and techniques
Perform static analysis on unknown binaries
Investigate potential trojans, ransomware, or other malware
Generate threat assessment reports

Workflow

Step 1: Perform Analysis

Use available Ghidra MCP tools to analyze the uploaded binary:

Decompilation: Convert assembly to pseudo-C code
String Analysis: Extract readable strings for IoC identification
Import/Export Analysis: Identify API calls and dependencies
Function Analysis: Map out program logic and control flow
Behavioral Indicators: Identify suspicious patterns (registry manipulation, network calls, process injection)

Step 2: Generate Report

Provide a comprehensive analysis including:

File metadata (size, hash, compilation timestamp)
Identified capabilities (network, file system, registry, process manipulation)
Suspicious indicators
Malware classification (if applicable)
Recommended actions

Analysis Techniques

Static Analysis

PE header examination
Section analysis (.text, .data, .rdata, .rsrc)
Import Address Table (IAT) review
String artifact extraction
Code signature verification

Behavioral Indicators

Look for:

Anti-debugging techniques
Obfuscation/packing
Suspicious API calls (CreateRemoteThread, WriteProcessMemory, etc.)
Network communication patterns
Persistence mechanisms
Privilege escalation attempts

Malware Classification

Common categories:

Trojan/RAT (Remote Access Trojan)
Ransomware
Adware/PUP (Potentially Unwanted Program)
Rootkit
Worm
Spyware
Browser hijacker

Safety Considerations

Never execute the binary on local system
All analysis occurs in remote sandbox environment
Files are automatically isolated
Use Ghidra static analysis tools only
Document all findings for incident response

Output Format

## Binary Analysis Report

**File Information**
- Name: [filename]
- Size: [bytes]
- MD5: [hash]
- SHA256: [hash]

**Analysis Summary**
[Brief overview of findings]

**Detailed Findings**
1. [Finding category]
   - Evidence: [specific data]
   - Significance: [what it means]

**Threat Assessment**
- Severity: [Critical/High/Medium/Low]
- Classification: [malware type]
- Confidence: [High/Medium/Low]

**Recommendations**
1. [Action item]
2. [Action item]

Example Usage

User: "I found a suspicious file called setup_installer.exe. Can you analyze it?"

Response: 1. Run Ghidra analysis on the full local path of setup_installer.exe 2. Extract strings, imports, and decompiled code 3. Identify malicious behavior (if any) 4. Provide detailed report with recommendations

{
  "skill": {
    "name": "binary-analysis",
    "description": "Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like 'Is [file] malicious?', 'Analyze [file]', 'What does [binary] do?', or any request involving binary file analysis.",
    "summary": "Analyze suspicious binary files for malware using Ghidra decompilation, string extraction, and threat assessment techniques.",
    "icon": "🛡️",
    "version": "1.0.0",
    "author": "DeepBits Technology",
    "license": "MIT",
    "category": "security",
    "tags": ["malware analysis", "reverse engineering", "threat detection", "binary decompilation", "security analysis"],
    "supported_tools": ["claude", "codex", "claude-code"]
  },
  "security_audit": {
    "risk_level": "safe",
    "is_blocked": false,
    "safe_to_publish": true,
    "summary": "Pure prompt-based skill containing only markdown documentation. No executable code, scripts, network operations, filesystem access, or environment variable access. Provides instructions for legitimate malware analysis using external Ghidra MCP tools.",
    "critical_findings": [],
    "high_findings": [],
    "medium_findings": [],
    "low_findings": [],
    "dangerous_patterns": [],
    "files_scanned": 1,
    "total_lines": 116,
    "risk_factors": [],
    "risk_factor_evidence": []
  },
  "content": {
    "user_title": "Analyze suspicious binary files for malware",
    "value_statement": "Security analysts need to quickly determine if unknown binary files are malicious without risking system infection. This skill provides structured analysis workflows using Ghidra decompilation and sandbox environments to safely examine suspicious executables and generate threat assessment reports.",
    "seo_keywords": [
      "binary analysis",
      "malware analysis",
      "reverse engineering",
      "Ghidra",
      "threat detection",
      "executable analysis",
      "decompilation",
      "malware scanning",
      "IOC extraction",
      "security analysis",
      "Claude",
      "Codex",
      "Claude Code"
    ],
    "actual_capabilities": [
      "Perform static analysis on PE files using Ghidra tools",
      "Extract and analyze strings, imports, and exports from binaries",
      "Decompile assembly to pseudo-C for behavior understanding",
      "Identify malware indicators and suspicious API patterns",
      "Generate comprehensive threat assessment reports",
      "Classify malware types including trojans, ransomware, and rootkits"
    ],
    "limitations": [
      "Requires access to Ghidra MCP tools and sandbox environment",
      "Cannot execute binaries locally for dynamic analysis",
      "Analysis depth depends on tool availability and binary obfuscation",
      "Cannot guarantee 100% detection of sophisticated packers or encryption"
    ],
    "use_cases": [
      {
        "target_user": "Security Analysts",
        "title": "Investigate suspicious downloads",
        "description": "Analyze email attachments or downloaded files to determine if they contain malicious code before safe handling."
      },
      {
        "target_user": "Incident Responders",
        "title": "Assess malware samples",
        "description": "Examine binary artifacts from compromised systems to understand capabilities and support remediation efforts."
      },
      {
        "target_user": "Security Researchers",
        "title": "Study malware behavior",
        "description": "Decompile and analyze unknown binaries to understand attack techniques and develop defenses."
      }
    ],
    "prompt_templates": [
      {
        "title": "Basic binary analysis",
        "scenario": "Analyze a suspicious file",
        "prompt": "Analyze the binary file at [file_path] using Ghidra. Extract strings, imports, exports, and decompile key functions. Provide a threat assessment report including file metadata, suspicious indicators, and recommended actions."
      },
      {
        "title": "Deep function analysis",
        "scenario": "Understand specific behavior",
        "prompt": "Focus on analyzing specific functions in [binary] that may indicate malicious behavior. Look for process injection APIs, registry manipulation, network calls, and anti-debugging techniques. List the most concerning functions with their decompiled code."
      },
      {
        "title": "Compare with known malware",
        "scenario": "Identify malware family",
        "prompt": "Analyze [binary] and compare extracted strings and imports against known malware patterns. Identify potential malware classification (trojan, ransomware, RAT, rootkit) based on behavioral indicators found in the code."
      },
      {
        "title": "Generate incident report",
        "scenario": "Document findings",
        "prompt": "Create a comprehensive malware analysis report for [binary] including: file hashes, compilation timestamp, identified capabilities, suspicious API calls, extracted IOCs (domains, IPs, mutexes, registry keys), threat severity, and remediation recommendations."
      }
    ],
    "output_examples": [
      {
        "input": "Analyze suspicious_setup.exe found in email attachments",
        "output": [
          "Binary Analysis Report for suspicious_setup.exe",
          "File size: 245KB | MD5: a1b2c3d4... | SHA256: e5f6...",
          "Identified capabilities: Registry modification, network communication, file creation",
          "Suspicious indicators: Uses CreateRemoteThread, connects to external IP",
          "Threat Classification: Trojan (High Confidence)",
          "Recommended actions: Isolate system, remove file, scan with AV"
        ]
      }
    ],
    "best_practices": [
      "Always run analysis in sandbox or isolated environments to prevent accidental infection",
      "Document all findings including hashes and extracted strings for incident tracking",
      "Use extracted IOCs (indicators of compromise) to check for broader system infection"
    ],
    "anti_patterns": [
      "Never execute suspicious binaries on your local system for any reason",
      "Do not rely solely on antivirus scans for unknown samples",
      "Avoid analyzing packed or encrypted binaries without first unpacking them"
    ],
    "faq": [
      {
        "question": "What file types can this skill analyze?",
        "answer": "Supports Windows executable formats including .exe, .dll, .sys, .ocx, .scr, .cpl, and .drv files."
      },
      {
        "question": "What are the size limits for analysis?",
        "answer": "Analysis limits depend on the Ghidra MCP tool configuration. Very large binaries may require chunked analysis."
      },
      {
        "question": "Can this skill integrate with my existing security tools?",
        "answer": "The skill works with Ghidra MCP tools. Integration with other tools requires additional configuration."
      },
      {
        "question": "Is my analysis data kept private?",
        "answer": "Analysis occurs in configured sandbox environments. Review your tool provider's privacy policy for data handling."
      },
      {
        "question": "Why is my analysis failing on obfuscated binaries?",
        "answer": "Obfuscated or packed binaries require manual unpacking before static analysis. Try dynamic analysis in sandbox."
      },
      {
        "question": "How does this compare to antivirus software?",
        "answer": "Antivirus uses signature matching while this skill performs code analysis. Both approaches complement each other."
      }
    ]
  }
}

{
  "schema_version": "2.0",
  "meta": {
    "generated_at": "2026-01-17T02:28:40.701Z",
    "slug": "deepbitstechnology-binary-analysis",
    "source_url": "https://github.com/DeepBitsTechnology/claude-plugins/tree/main/drbinary-chat-plugin/skills/binary-analysis",
    "source_ref": "main",
    "model": "claude",
    "analysis_version": "3.0.0",
    "source_type": "community",
    "content_hash": "0893c64a01e1bf7d4604fdbc443bc9ddc4ec9ee27f9cdba88568c3f1a1b67fbc",
    "tree_hash": "a7a1c100467090696c2e57d4ccc8954cd014e096fb0b442f8c0d0650cab5d544"
  },
  "skill": {
    "name": "binary-analysis",
    "description": "Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like \"Is [file] malicious?\", \"Analyze [file]\", \"What does [binary] do?\", or any request involving binary file analysis.",
    "summary": "Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perfo...",
    "icon": "🛡️",
    "version": "1.0.0",
    "author": "DeepBitsTechnology",
    "license": "MIT",
    "category": "security",
    "tags": [
      "malware analysis",
      "reverse engineering",
      "threat detection",
      "binary decompilation",
      "security analysis"
    ],
    "supported_tools": [
      "claude",
      "codex",
      "claude-code"
    ],
    "risk_factors": [
      "network",
      "external_commands"
    ]
  },
  "security_audit": {
    "risk_level": "safe",
    "is_blocked": false,
    "safe_to_publish": true,
    "summary": "Pure documentation-only skill containing markdown prompts for malware analysis. Static scanner flagged keyword patterns (ransomware, malware, MD5) that appear in legitimate security documentation context, not executable code. The skill provides instructions for using external Ghidra MCP tools and contains no scripts, network operations, or filesystem access. All 46 static findings are false positives from pattern matching without semantic context.",
    "risk_factor_evidence": [
      {
        "factor": "network",
        "evidence": [
          {
            "file": "skill-report.json",
            "line_start": 6,
            "line_end": 6
          }
        ]
      },
      {
        "factor": "external_commands",
        "evidence": [
          {
            "file": "SKILL.md",
            "line_start": 80,
            "line_end": 105
          }
        ]
      }
    ],
    "critical_findings": [],
    "high_findings": [],
    "medium_findings": [],
    "low_findings": [],
    "dangerous_patterns": [],
    "files_scanned": 3,
    "total_lines": 448,
    "audit_model": "claude",
    "audited_at": "2026-01-17T02:28:40.701Z"
  },
  "content": {
    "user_title": "Analyze suspicious binary files for malware",
    "value_statement": "Security analysts need to quickly determine if unknown binary files are malicious without risking system infection. This skill provides structured analysis workflows using Ghidra decompilation and sandbox environments to safely examine suspicious executables and generate threat assessment reports.",
    "seo_keywords": [
      "binary analysis",
      "malware analysis",
      "reverse engineering",
      "Ghidra",
      "threat detection",
      "executable analysis",
      "decompilation",
      "malware scanning",
      "IOC extraction",
      "security analysis",
      "Claude",
      "Codex",
      "Claude Code"
    ],
    "actual_capabilities": [
      "Perform static analysis on PE files using Ghidra tools",
      "Extract and analyze strings, imports, and exports from binaries",
      "Decompile assembly to pseudo-C for behavior understanding",
      "Identify malware indicators and suspicious API patterns",
      "Generate comprehensive threat assessment reports",
      "Classify malware types including trojans, ransomware, and rootkits"
    ],
    "limitations": [
      "Requires access to Ghidra MCP tools and sandbox environment",
      "Cannot execute binaries locally for dynamic analysis",
      "Analysis depth depends on tool availability and binary obfuscation",
      "Cannot guarantee 100% detection of sophisticated packers or encryption"
    ],
    "use_cases": [
      {
        "target_user": "Security Analysts",
        "title": "Investigate suspicious downloads",
        "description": "Analyze email attachments or downloaded files to determine if they contain malicious code before safe handling."
      },
      {
        "target_user": "Incident Responders",
        "title": "Assess malware samples",
        "description": "Examine binary artifacts from compromised systems to understand capabilities and support remediation efforts."
      },
      {
        "target_user": "Security Researchers",
        "title": "Study malware behavior",
        "description": "Decompile and analyze unknown binaries to understand attack techniques and develop defenses."
      }
    ],
    "prompt_templates": [
      {
        "title": "Basic binary analysis",
        "scenario": "Analyze a suspicious file",
        "prompt": "Analyze the binary file at [file_path] using Ghidra. Extract strings, imports, exports, and decompile key functions. Provide a threat assessment report including file metadata, suspicious indicators, and recommended actions."
      },
      {
        "title": "Deep function analysis",
        "scenario": "Understand specific behavior",
        "prompt": "Focus on analyzing specific functions in [binary] that may indicate malicious behavior. Look for process injection APIs, registry manipulation, network calls, and anti-debugging techniques. List the most concerning functions with their decompiled code."
      },
      {
        "title": "Compare with known malware",
        "scenario": "Identify malware family",
        "prompt": "Analyze [binary] and compare extracted strings and imports against known malware patterns. Identify potential malware classification (trojan, ransomware, RAT, rootkit) based on behavioral indicators found in the code."
      },
      {
        "title": "Generate incident report",
        "scenario": "Document findings",
        "prompt": "Create a comprehensive malware analysis report for [binary] including: file hashes, compilation timestamp, identified capabilities, suspicious API calls, extracted IOCs (domains, IPs, mutexes, registry keys), threat severity, and remediation recommendations."
      }
    ],
    "output_examples": [
      {
        "input": "Analyze suspicious_setup.exe found in email attachments",
        "output": [
          "Binary Analysis Report for suspicious_setup.exe",
          "File size: 245KB | MD5: a1b2c3d4... | SHA256: e5f6...",
          "Identified capabilities: Registry modification, network communication, file creation",
          "Suspicious indicators: Uses CreateRemoteThread, connects to external IP",
          "Threat Classification: Trojan (High Confidence)",
          "Recommended actions: Isolate system, remove file, scan with AV"
        ]
      }
    ],
    "best_practices": [
      "Always run analysis in sandbox or isolated environments to prevent accidental infection",
      "Document all findings including hashes and extracted strings for incident tracking",
      "Use extracted IOCs (indicators of compromise) to check for broader system infection"
    ],
    "anti_patterns": [
      "Never execute suspicious binaries on your local system for any reason",
      "Do not rely solely on antivirus scans for unknown samples",
      "Avoid analyzing packed or encrypted binaries without first unpacking them"
    ],
    "faq": [
      {
        "question": "What file types can this skill analyze?",
        "answer": "Supports Windows executable formats including exe, dll, sys, ocx, scr, cpl, and drv files."
      },
      {
        "question": "What are the size limits for analysis?",
        "answer": "Analysis limits depend on the Ghidra MCP tool configuration. Very large binaries may require chunked analysis."
      },
      {
        "question": "Can this skill integrate with my existing security tools?",
        "answer": "The skill works with Ghidra MCP tools. Integration with other tools requires additional configuration."
      },
      {
        "question": "Is my analysis data kept private?",
        "answer": "Analysis occurs in configured sandbox environments. Review your tool provider privacy policy for data handling."
      },
      {
        "question": "Why is my analysis failing on obfuscated binaries?",
        "answer": "Obfuscated or packed binaries require manual unpacking before static analysis. Try dynamic analysis in sandbox."
      },
      {
        "question": "How does this compare to antivirus software?",
        "answer": "Antivirus uses signature matching while this skill performs code analysis. Both approaches complement each other."
      }
    ]
  },
  "file_structure": [
    {
      "name": "audit_output.json",
      "type": "file",
      "path": "audit_output.json",
      "lines": 150
    },
    {
      "name": "SKILL.md",
      "type": "file",
      "path": "SKILL.md",
      "lines": 116
    }
  ]
}