Agent skill · security · aiskillstore
binary-analysis
Analyze binary files (exe, dll, sys, bin, ocx, scr, cpl, drv) to assess if they are malicious, perform decompilation, extract strings/imports/exports, detect malware, and provide threat assessment. Use this skill when user asks to analyze, examine, check, or assess any binary file, asks if a file is malicious/suspicious/safe, or provides a file path to a binary. Trigger for phrases like "Is [file] malicious?", "Analyze [file]", "What does [binary] do?", or any request involving binary file analysis.
Why this skill is useful
Adds executable workflows for binary analysis using Ghidra and sandbox environments that are not commonly known or documented.
What it needs
Requires ghidra installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Binary Analysis This skill enables deep analysis of suspicious binary files using remote Ghidra tools and sandbox environments. You HAVE TO upload binary files to the remote first before calling any Ghidra or sandbox tools. When to Use This Skill Use this skill when you need to: Analyze suspicious executable files (.exe, .dll, .sys) Decompile binaries to understand their behavior Extract strings, imports, and exports from files Identify malware capabilities and techniques Perform static analysis on unknown binaries Investigate potential trojans, ransomware, or other malware Generate threat assessment reports Workflow Step 1: Perform Analysis Use available Ghidra MCP tools to analyze the uploaded binary: Decompilation: Convert assembly to pseudo-C code String Analysis: Extract readable strings for IoC identification Import/Export Analysis: Identify API calls and dependencies Function Analysis: Map out program logic and control flow Behavioral Indicators: Identify suspicious patterns (registry manipulation, network calls, process injection) Step 2: Generate Report Provide a comprehensive analysis including: File metadata (size, hash, compilation timestamp) Identified capabilities (network, file system, registry, process manipulation) Suspicious indicators Malware classification (if applicable) Recommended actions Analysis Techniques Static Analysis PE header examination Section analysis (.text, .data, .rdata, .rsrc) Import Address Table (IAT) review String artifact extraction Code signature verification Behavioral Indicators Look for: Anti-debugging techniques Obfuscation/packing Suspicious API calls (CreateRemoteThread, WriteProcessMemory, etc.) Network communication patterns Persistence mechanisms Privilege escalation attempts Malware Classification Common categories: Trojan/RAT (Remote Access Trojan) Ransomware Adware/PUP (Potentially Unwanted Program) Rootkit Worm Spyware Browser hijacker Safety Considerations Never execute the binary on local system All analysis …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/binary-analysis