About

Imported from meltedinhex/analyst-ai-pack (skills/writing-a-malware-analysis-report/SKILL.md). Install upstream with npx skills add meltedinhex/analyst-ai-pack --skill writing-a-malware-analysis-report. Copyright stays with the author (Apache-2.0).

Writing a Malware Analysis Report

Name: writing-a-malware-analysis-report
Author: meltedinhex

When to Use

You have completed static, dynamic, or reverse-engineering analysis and need to communicate findings to responders, detection engineers, and leadership.
You need a consistent report structure so findings are actionable and comparable across samples.
You are reviewing a draft report for completeness before distribution.

Do not use this as a substitute for analysis; a report only documents work already done. Do not pad a report with tool output that has no analytic conclusion.

Prerequisites

Completed analysis artifacts: sample hashes, behavioral notes, extracted IOCs, screenshots, and any reversed routines.
An ATT&CK reference for mapping observed behaviors to techniques.

Workflow

Step 1: Lead with an executive summary

Three to five sentences a non-analyst can act on: what the sample is, what it does, the risk, and the recommended action. State your confidence and the basis for it.

Step 2: Record sample identity

A table the reader can match against their telemetry:

Filename (as received) : invoice.exe
SHA-256                : 9f86d0818...
SHA-1 / MD5            : ...
File type / size        : PE32 executable / 412 KB
First seen / source     : 2026-06-20 / MalwareBazaar
Signing                 : unsigned / invalid certificate

Step 3: Describe capabilities, not just events

Group findings by capability (persistence, C2, defense evasion, collection), each with the evidence and the ATT&CK technique:

Persistence  : Run key HKCU\...\Run "Updater" -> %APPDATA%\svc.exe   [T1547.001]
C2           : HTTPS beacon to evil[.]com/api every 60s +/- jitter   [T1071.001]
Defense evasion: UPX-packed; checks for VM artifacts before running  [T1027, T1497]

Step 4: Provide IOCs in a usable form

Defanged for reading, plus a machine-ingestible block (CSV/STIX/MISP) for detection teams. Separate host IOCs (paths, registry keys, mutexes) from network IOCs (domains, IPs, URLs, JA3).

Step 5: Give detection and response guidance

Concrete next steps: YARA/Sigma rules, what to hunt for, containment, and remediation.

Step 6: Generate the skeleton and validate completeness

python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
python scripts/analyst.py check report.md

Validation

An incident responder can act on the report without reading the raw tool logs.
Every capability claim cites specific evidence (offset, registry key, packet, decompiled routine).
IOCs appear both defanged (for humans) and in a structured block (for tools).
ATT&CK techniques are valid current IDs and tied to observed behavior, not guessed.

Pitfalls

Dumping raw tool output without interpretation — the reader needs conclusions.
Overclaiming attribution ("this is APT-X") from weak signals; state confidence and evidence instead.
Mixing host and network IOCs, or leaving IOCs clickable in the human-readable section.
Mapping to ATT&CK techniques that the evidence does not actually support.

References

See references/api-reference.md for the scaffold and completeness-check tooling.
MITRE ATT&CK and MISP/STIX IOC formats (linked in frontmatter).

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/meltedinhex-analyst-ai-pack-writing-a-malware-analysis-report/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

meltedinhex-analyst-ai-pack-writing-a-malware-analysis-report.ocm.jsonjson

{
  "ocm": "1",
  "id": "meltedinhex-analyst-ai-pack-writing-a-malware-analysis-report",
  "kind": "skill",
  "name": "writing-a-malware-analysis-report",
  "description": "Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.",
  "publisher": "meltedinhex",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "malware",
      "reporting",
      "ioc",
      "mitre-attack",
      "documentation",
      "detection",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/meltedinhex/analyst-ai-pack",
      "path": "skills/writing-a-malware-analysis-report/SKILL.md",
      "ref": "da7600a745bb4c3b487ab775b681c04e71e973d4",
      "url": "https://github.com/meltedinhex/analyst-ai-pack/blob/da7600a745bb4c3b487ab775b681c04e71e973d4/skills/writing-a-malware-analysis-report/SKILL.md",
      "key": "meltedinhex/analyst-ai-pack/skills/writing-a-malware-analysis-report/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Writing a Malware Analysis Report\n\n## When to Use\n\n- You have completed static, dynamic, or reverse-engineering analysis and need to communicate\n  findings to responders, detection engineers, and leadership.\n- You need a consistent report structure so findings are actionable and comparable across\n  samples.\n- You are reviewing a draft report for completeness before distribution.\n\n**Do not use** this as a substitute for analysis; a report only documents work already done.\nDo not pad a report with tool output that has no analytic conclusion.\n\n## Prerequisites\n\n- Completed analysis artifacts: s",
  "cost": {
    "context_tokens": 823
  }
}

Fetch it by URL: GET /api/v1/registry/meltedinhex-analyst-ai-pack-writing-a-malware-analysis-report/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.