/classify

description: Malware classification — YARA scanning, entropy analysis, packer detection
allowed-tools: Bash, Read, Write, Glob, Grep
argument-hint: <path-to-binary>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Malware Classification

Parse `$ARGUMENTS` to get the binary path.

Step 1 — Hash & Identify

node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "$ARGUMENTS"

Step 2 — Entropy Analysis

Use radare2 for per-section entropy:

r2 -qc 'iS~entropy' <binary>

Or use Python pefile:

python3 -c "
import pefile, math
pe = pefile.PE('$ARGUMENTS')
for s in pe.sections:
    data = s.get_data()
    if len(data) == 0: continue
    entropy = 0
    for x in range(256):
        p = data.count(bytes([x])) / len(data)
        if p > 0: entropy -= p * math.log2(p)
    name = s.Name.decode().rstrip('\x00')
    print(f'{name}: entropy={entropy:.2f} size={len(data)}')
"

Interpretation:

• **0-1**: Empty/null data
• **1-5**: Normal code/data
• **5-7**: Compressed or obfuscated
• **7-8**: Encrypted or packed (HIGH confidence)

Step 3 — Packer Detection

Known packer signatures:

• **UPX**: Section names `UPX0`, `UPX1`, or `UPX!` magic
• **ASPack**: Section name `.aspack` or `.adata`
• **Themida**: Section name `.winlicense` or `.themida`
• **VMProtect**: Section name `.vmp0`, `.vmp1`
• **.NET Reactor**: `.reacto` section
• **Enigma Protector**: `.enigma` section

Check with `file`:

file <binary> | grep -i "packed\|UPX\|compressed"

Step 4 — YARA Scan

yara -r /usr/share/yara/rules/ <binary> 2>/dev/null
yara -r /opt/yara-rules/ <binary> 2>/dev/null

If no YARA rules are installed, note this and suggest installing community rulesets.

Step 5 — ssdeep Similarity

ssdeep <binary>

Compare against known samples if a reference database exists.

Step 6 — IOC Extraction

From strings and structure, extract:

• C2 server addresses (URLs, IPs)
• Mutex names (unique identifiers)
• Dropped file paths
• Registry persistence keys
• Scheduled task names
• Service names

Log IOCs:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<binary>" "ioc-c2" "<value>" "<severity>" "<title>" --db ioc

Step 7 — Classification Verdict

Provide a verdict based on analysis:

• **CLEAN**: Low entropy, standard imports, no suspicious patterns
• **SUSPICIOUS**: Some anomalies but no confirmed malicious behavior
• **LIKELY MALICIOUS**: Multiple indicators (suspicious imports, C2 patterns, anti-debug)
• **PACKED**: High entropy, cannot classify without unpacking first

Save report to `classify-<binary-name>.md`.