A collection of independent malware analysis write-ups covering well-known offensive-security tools, commodity malware families, and a handful of "is this actually malicious?" investigations on ambiguous or bundled binaries.
Every report follows the same methodology and structure:
- Threat intelligence — hashing, VirusTotal / Hybrid Analysis triage, sandbox telemetry (network activity, process trees, registry behaviour, MITRE ATT&CK mapping where available).
- Static analysis — file typing, packer/protector identification (Detect It Easy), entropy, import table review, string extraction.
- Reverse engineering — manual disassembly / decompilation (Ghidra, radare2, objdump), with annotated screenshots of the actual analysis session and a plain-language explanation of what each function or code block does.
- Verdict — a clear, evidence-backed conclusion (malicious / benign / suspicious), including false-positive investigations where the initial detection did not hold up.
All screenshots are taken directly from the analyst's own working sessions (VirusTotal, Hybrid Analysis, Detect It Easy, Ghidra, radare2, terminal output) and are captioned as evidence for the specific claim they support. No finding in these reports is invented — every hash, IOC, function name, and address comes from the original investigation.
| Report | Verdict | Summary |
|---|---|---|
| Mimikatz | Malicious / dual-use | Credential-dumping tool — dynamic API dispatch engine behind sekurlsa::* and friends |
| Meterpreter | Malicious | Metasploit reverse_tcp stager — PEB walking, ROR13 API hashing, in-memory second-stage execution |
| RedLine Stealer | Malicious | Multi-stage loader reconstructing its payload through COM/OLE Automation structures |
| BlackLotus | Malicious | UEFI bootkit — custom PE-parsing API resolver with a proprietary hashing scheme |
| Webplayer.exe | Malicious | UPX-packed AutoIt loader deploying a keylogger/stealer via process hollowing |
| TheFatRat payload | Malicious | UPX-packed, heavily obfuscated backdoor generated from an older TheFatRat module |
| RealPlayer downloader | Malicious | MFC-based backdoor/keylogger disguised as a software download |
| veetle-0.9.19 | Suspicious | Legitimate P2P client bundled with an unrelated, credential-access-capable loader |
| la_meuh.exe | Benign (false positive) | Author's own winget GUI wrapper, cleared after full static + RE investigation |
| X17-75061.exe | Benign (false positive) | ~1 GB unidentified binary, confirmed as a legitimate Office 2010 SP1 (FR) installer |
reports/ All reports (PDF), one file per sample analysed
- Triage / threat intel: VirusTotal, Hybrid Analysis
- Static analysis: Detect It Easy (DIE),
file,objdump,strings,binwalk, entropy analysis - Reverse engineering: Ghidra, radare2 / rabin2
- Environment: Kali Linux
These reports are written by a Security Engineer / CTI & DFIR Analyst currently working in a purple team role at a cybersecurity company, previously on the SOC/blue team side of the same organisation. Relevant certifications: Blue Team Level 1, Security Analyst Level 1, Certified CyberDefender Level 1, Security+, Network+, Pentester (M2i), Security 101, Tosa DigComp, Administrateur réseau (FormIP), Permis d'OSINT (Oscar Zulu Crew).
These reports are shared for educational and portfolio purposes. No live malware samples are included in this repository — only analysis write-ups, extracted indicators, and screenshots of the analysis process.