reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Analyzing Wiper Malware
+
+## Overview
+
+`scripts/analyst.py` scans a sample for destructive wiper primitives (raw-disk/MBR overwrite,
+recovery denial, mass deletion) and weighs them against ransomware indicators to classify intent
+as wiper, ransomware, or a destructive-with-ransom-facade hybrid. It reads bytes statically
+(ASCII + UTF-16LE) and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `scan(path)`
+Returns destructive primitive groups, ransomware indicators, the two scores, and a classification.
+
+## Classification logic
+
+- `destructive_score` ≥ 3 and `ransomware_score` ≤ 1 → **likely_wiper**.
+- `ransomware_score` ≥ 3 → **likely_ransomware**.
+- Both present → **destructive_with_ransom_facade** (pseudo-ransomware wiper).
+
+## Indicators
+
+- Raw disk: `\\.\PhysicalDrive`, `DeviceIoControl`, `IOCTL_DISK`.
+- Recovery denial: `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`,
+  `wevtutil cl`.
+
+## Usage
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1561 Disk Wipe; T1485 Data Destruction — https://attack.mitre.org/
+- Raw-disk/boot-record APIs from Windows storage documentation
+- Wiper recovery-denial command patterns from public destructive-malware analyses