---
description: Analisa malware/payload/sample — reverse engineering, behavior analysis
---

# Analyze Sample

## Pre-Read Skills
```
view_file: ~/.gemini/skills/mindset/SKILL.md
view_file: ~/.gemini/skills/knowledge/SKILL.md
```

## Steps

1. **Identify Sample**
   ```
   view_file on the sample file
   ```

2. **Static Analysis**
   Apply `mindset` intelligence synthesis:
   - File type, size, entropy
   - String extraction (URLs, IPs, domains, keys)
   - Import table / function calls
   - Obfuscation detection

3. **Deobfuscation**
   Using `knowledge` skill encoding techniques:
   - Identify encoding (base64, XOR, custom)
   - Write deobfuscation script
   - Extract hidden logic

4. **Behavior Mapping**
   Apply `mindset` workflow reconstruction:
   - Network connections (C2, exfil endpoints)
   - File operations (drop, delete, modify)
   - Persistence mechanisms
   - Evasion techniques used

5. **IOC Extraction**
   Pull all Indicators of Compromise:
   - Domains, IPs, URLs, file hashes
   - Registry keys, mutex names

6. **Report**
   Generate analysis artifact with classification, behavior timeline, IOC list.