reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-loaders-and-droppers/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-loaders-and-droppers/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: analyzing-loaders-and-droppers
+description: 'Analyzes loader and dropper samples by identifying staging behavior — embedded or
+  downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run
+  the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or
+  map multi-stage delivery behavior.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - loader
+  - dropper
+  - multi-stage
+  - delivery
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1105
+  - T1140
+  - T1574
+d3fend:
+  - D3-DA
+  - D3-FCR
+references:
+  - 'MITRE ATT&CK T1105 Ingress Tool Transfer — https://attack.mitre.org/techniques/T1105/'
+  - 'MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/'
+---
+
+# Analyzing Loaders and Droppers
+
+## When to Use
+
+- You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an
+  appended overlay, or a download URL.
+- You need to identify the decode/decrypt routine and the execution mechanism (process creation,
+  injection, scheduled task, DLL side-loading).
+
+**Do not use** this to run the loader and fetch live stages — characterize staging statically and
+retrieve next stages only in an isolated sandbox.
+
+## Prerequisites
+
+- The loader/dropper sample (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; defang download URLs; never execute to pull live payloads.
+
+## Workflow
+
+### Step 1: Locate staged payloads
+
+```bash
+python scripts/analyst.py stage sample.bin
+```
+
+Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large
+high-entropy blobs, and download URLs.
+
+### Step 2: Identify decode/execution mechanism
+
+Scan imports/strings for decode APIs (`CryptDecrypt`, base64), download APIs (`URLDownloadToFile`,
+`WinHttp`, `InternetReadFile`), and execution (`CreateProcess`, `ShellExecute`, `WinExec`,
+side-loading hints).
+
+### Step 3: Map the delivery chain
+
+Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK.
+
+### Step 4: Defang and report
+
+Defang URLs and produce IOCs for the staging infrastructure.
+
+## Validation
+
+- Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded.
+- Download URLs and execution mechanism are identified from imports/strings.
+- The multi-stage chain maps cleanly to ATT&CK techniques.
+
+## Pitfalls
+
+- Treating a benign overlay (installer data, signature) as a payload without corroboration.
+- Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded).
+- Confusing the decode routine for the payload itself.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the stager.
+- ATT&CK T1105 and T1140 (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-loaders-and-droppers/references/api-reference.md

@@ -0,0 +1,41 @@
+# API Reference: Analyzing Loaders and Droppers
+
+## Overview
+
+`scripts/analyst.py` analyzes a loader/dropper: it finds embedded PE/archive signatures (skipping
+the loader's own header), counts high-entropy windows (packed/encrypted stages), and scans strings
+for download, decode, and execution APIs plus URLs. It reads bytes statically, defangs URLs, and
+executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | math, regex, Counter, JSON, file IO |
+
+## Core functions
+
+### `stage(path)`
+Returns embedded signatures, high-entropy window count, download/decode/execution API hits,
+defanged URLs, and a loader likelihood flag.
+
+### `_entropy(chunk)`
+Shannon entropy (bits/byte) over a window; >7.2 suggests compressed/encrypted data.
+
+## API categories
+
+- **download**: `URLDownloadToFile`, `InternetReadFile`, WinHTTP/WinINet.
+- **decode**: `CryptDecrypt`, `CryptStringToBinary`, base64/RC4/XOR.
+- **execution**: `CreateProcess`, `ShellExecute`, `WinExec`, `CreateRemoteThread`, `LoadLibrary`.
+
+## Usage
+
+```bash
+python scripts/analyst.py stage sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1105 Ingress Tool Transfer — https://attack.mitre.org/techniques/T1105/
+- MITRE ATT&CK T1140 Deobfuscate/Decode Information — https://attack.mitre.org/techniques/T1140/
+- Shannon entropy definition; overlay/staging patterns from public loader analyses

vendor-new/analyst-ai-pack/skills/analyzing-loaders-and-droppers/scripts/analyst.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Analyze a loader/dropper: locate staged payloads and identify decode/download/execution APIs.
+
+Detects embedded PE/archive signatures, scans strings for download/decode/execution APIs and
+URLs, and computes Shannon entropy over windows to flag large high-entropy (packed/encrypted)
+blobs. Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+UTF16_RE = re.compile(rb"(?:[\x20-\x7e]\x00){4,}")
+RE_URL = re.compile(r"https?://[^\s\"'<>]+", re.I)
+
+EMBED_SIGS = [(b"MZ", "PE"), (b"PK\x03\x04", "ZIP/Office"), (b"Rar!\x1a\x07", "RAR"),
+              (b"\x1f\x8b", "GZIP"), (b"7z\xbc\xaf\x27\x1c", "7z")]
+
+DOWNLOAD_API = ["urldownloadtofile", "internetreadfile", "internetopenurl", "winhttp",
+                "httpopenrequest", "wininet"]
+DECODE_API = ["cryptdecrypt", "cryptstringtobinary", "base64", "rc4", "xor"]
+EXEC_API = ["createprocess", "shellexecute", "winexec", "createremotethread", "loadlibrary",
+            "ntcreateuserprocess", "wow64"]
+
+
+def _strings(data: bytes) -> str:
+    parts = [m.decode("ascii", "ignore") for m in ASCII_RE.findall(data)]
+    parts += [m.decode("utf-16-le", "ignore") for m in UTF16_RE.findall(data)]
+    return "\n".join(parts)
+
+
+def _entropy(chunk: bytes) -> float:
+    if not chunk:
+        return 0.0
+    counts = Counter(chunk)
+    total = len(chunk)
+    return -sum((c / total) * math.log2(c / total) for c in counts.values())
+
+
+def stage(path: str) -> dict:
+    data = Path(path).read_bytes()
+    embedded = []
+    for sig, label in EMBED_SIGS:
+        idx = data.find(sig, 1)  # skip offset 0 (the loader's own header)
+        if idx != -1:
+            embedded.append({"offset": idx, "type": label})
+    win = 4096
+    high_entropy = sum(1 for i in range(0, len(data), win)
+                       if _entropy(data[i:i + win]) > 7.2)
+    blob = _strings(data)
+    low = blob.lower()
+    urls = sorted({u.replace("http", "hxxp").replace(".", "[.]") for u in RE_URL.findall(blob)})
+    return {
+        "embedded_signatures": embedded,
+        "high_entropy_windows": high_entropy,
+        "download_apis": sorted({a for a in DOWNLOAD_API if a in low}),
+        "decode_apis": sorted({a for a in DECODE_API if a in low}),
+        "execution_apis": sorted({a for a in EXEC_API if a in low}),
+        "urls": urls[:50],
+        "is_likely_loader": bool(embedded) or bool(urls and any(a in low for a in DOWNLOAD_API)),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Analyze loader/dropper staging")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("stage")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(stage(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())