reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/references/api-reference.md

API Reference: Analyzing Wiper Malware

Overview

scripts/analyst.py scans a sample for destructive wiper primitives (raw-disk/MBR overwrite, recovery denial, mass deletion) and weighs them against ransomware indicators to classify intent as wiper, ransomware, or a destructive-with-ransom-facade hybrid. It reads bytes statically (ASCII + UTF-16LE) and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

scan(path)

Returns destructive primitive groups, ransomware indicators, the two scores, and a classification.

Classification logic

• destructive_score ≥ 3 and ransomware_score ≤ 1 → likely_wiper.
• ransomware_score ≥ 3 → likely_ransomware.
• Both present → destructive_with_ransom_facade (pseudo-ransomware wiper).

Indicators

• Raw disk: \\.\PhysicalDrive, DeviceIoControl, IOCTL_DISK.
• Recovery denial: vssadmin delete shadows, wbadmin delete, bcdedit /set recoveryenabled no, wevtutil cl.

Usage

python scripts/analyst.py scan sample.bin

Sources

• MITRE ATT&CK T1561 Disk Wipe; T1485 Data Destruction — https://attack.mitre.org/
• Raw-disk/boot-record APIs from Windows storage documentation
• Wiper recovery-denial command patterns from public destructive-malware analyses