reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-report-writer/assets/report_template.md

Malware Analysis Report

Analyst: [Your Name]
Date: [Analysis Date]
Sample Hash (SHA256): [Hash]
Report ID: [Unique ID]

---

Executive Summary

[2-3 paragraph high-level summary suitable for non-technical stakeholders]

Key Findings:

• Malware Family: [Family name or "Unknown"]
• Threat Level: [Critical/High/Medium/Low]
• Primary Functionality: [Brief description]
• Recommended Actions: [Immediate actions needed]

---

Sample Information

Field	Value
Filename	[Original filename]
File Size	[Size in bytes/KB/MB]
File Type	[PE32/PE64/Script/Document/etc]
MD5	[MD5 hash]
SHA1	[SHA1 hash]
SHA256	[SHA256 hash]
First Seen	[Date/Time or "Unknown"]

---

Static Analysis

File Header Analysis

PE Structure:

• Architecture: [x86/x64/ARM]
• Compilation Timestamp: [Date/Time]
• Entry Point: [Address]
• Sections: [Number and names]

Packing/Obfuscation:

• Packed: [Yes/No]
• Packer Identified: [Name or "Unknown"]
• Entropy: [Value - High entropy suggests packing/encryption]

Strings Analysis

Notable Strings:

• [Key strings that indicate functionality, URLs, file paths, registry keys]
• [Decoded/deobfuscated strings if applicable]

Import/Export Analysis

Key Imports:

• [DLL name]: [Notable functions that indicate malicious behavior]
• [Example: kernel32.dll: CreateRemoteThread, VirtualAllocEx (process injection)]
• [Example: ws2_32.dll: socket, connect, send (network communication)]

Exports:

• [List any exported functions]

Resource Analysis

Embedded Resources:

• [Icons, images, additional executables, configuration data]
• [Any suspicious or high-entropy resources]

---

Dynamic Analysis

Behavioral Analysis

Execution Environment:

• Operating System: [Windows version, architecture]
• Analysis Tools: [List tools used: Process Monitor, Wireshark, etc.]
• Analysis Duration: [Time period]

Process Activity

Process Creation:

• [Parent process → Child processes]
• [Process injection or hollowing detected]

Command Line Arguments:

• [Any command line execution observed]

File System Activity

Files Created/Modified:

Files Deleted:

• [List any files deleted]

Registry Activity

Registry Keys Created/Modified:

• [Registry path]: [Value and purpose]
• [Persistence mechanisms identified]

Notable Registry Operations:

• [Any suspicious registry behavior]

Network Activity

DNS Queries:

• [Domain]: [IP resolved]
• [Suspicious or newly registered domains]

Network Connections:

• Protocol: [TCP/UDP/HTTP/HTTPS]
• Remote Address: [IP:Port]
• Purpose: [C2 communication/Data exfiltration/Download additional payload]

Network Indicators:

• [User-Agent strings]
• [URI patterns]
• [HTTP headers]

System Changes

Mutex Creation:

• [Mutex names - used to prevent multiple infections]

Service Installation:

• [Service name, display name, description]

Scheduled Tasks:

• [Task name and trigger]

---

Indicators of Compromise (IOCs)

Note: All network and host IOCs MUST be defanged before inclusion in this report. Defanging rules: URLs use hxxp/hxxps; domains bracket the dot before the TLD (evil[.]com); IP addresses bracket each dot (192[.]168[.]1[.]1); email addresses replace @ with [@].

File Indicators

MD5: [hash]
SHA1: [hash]
SHA256: [hash]
Filename: [name]
File Size: [size]

Network Indicators

IP Addresses:
[192.168.1.1] → 192[.]168[.]1[.]1 - [Purpose/Description]

Domains:
[domain.com] → domain[.]com - [Purpose/Description]

URLs:
[https://example.com/path] → hxxps://example[.]com/path - [Purpose/Description]

Host Indicators

Registry Keys:
[Registry path]

File Paths:
[File path]

Mutex Names:
[Mutex name]

Service Names:
[Service name]

---

Detection Rules

YARA Rule

rule [RuleName]_[MalwareFamily] {
    meta:
        description = "[Brief description]"
        author = "[Your name]"
        date = "[Date]"
        hash = "[Sample SHA256]"
        
    strings:
        $string1 = "[hex or text pattern]" [modifiers]
        $string2 = "[hex or text pattern]" [modifiers]
        $api1 = "[API call pattern]"
        
    condition:
        [Condition logic - e.g., uint16(0) == 0x5A4D and filesize < 500KB and all of ($string*)]
}

Sigma Rule (Optional - for behavioral detection)

title: [Detection Name]
id: [generate a unique UUID, e.g. a1b2c3d4-e5f6-7890-abcd-ef1234567890]
status: experimental
description: [What behavior this detects]
references:
    - [URLs or references]
author: [Your Name]
date: [YYYY-MM-DD]
tags:
    - attack.[tactic]         # e.g. attack.execution
    - attack.t[XXXX].[YYY]   # e.g. attack.t1059.001
logsource:
    category: [process_creation/network_connection/etc]
    product: windows
detection:
    selection:
        [Field]: [Value]
    condition: selection
falsepositives:
    - [Potential false positives]
level: [critical/high/medium/low]

---

Malware Classification

Family: [Malware family name or "Unknown"]
Type: [Trojan/Ransomware/Worm/RAT/Backdoor/Dropper/Loader/etc]
Capabilities:

• [Capability 1 - e.g., Data exfiltration]
• [Capability 2 - e.g., Remote access]
• [Capability 3 - e.g., Keylogging]

---

Remediation and Mitigation

Immediate Actions

1. [Isolate infected systems]
2. [Block network IOCs at firewall/proxy]
3. [Search for other instances using IOCs]

Long-term Recommendations

1. [Update endpoint protection signatures]
2. [Deploy detection rules]
3. [Review and strengthen security controls]
4. [User awareness training if applicable]

Recovery Steps

1. [Remove malware using antivirus/manual removal]
2. [Restore from clean backups if needed]
3. [Reset compromised credentials]
4. [Monitor for reinfection]

---

Technical Details

[Additional technical information, screenshots, memory dumps analysis, code snippets, etc.]

---

Conclusion

[Final summary paragraph with key takeaways and overall assessment]

---

References

• [VirusTotal Report Link]
• [Any.Run Sandbox Report]
• [External research/blog posts about similar samples]
• [CVE numbers if applicable]

---

Appendix

Analysis Timeline

Tools Used

• [Tool name and version]
• [Tool name and version]

Screenshots

[Include relevant screenshots from analysis]