SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-golang-malware-internals
0
Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Golang Malware Internals ## When to Use - You have a Go-compiled binary (often large, statically linked) and standard symbol recovery fails because user symbols are stripped. - You need function names from the pclntab, the Go version, and embedded package/module paths. **Do not use** this for non-Go binaries — confirm the Go build signature first. This skill reads the binary statically and executes nothing. ## Prerequisites - The Go binary (read inertly). ## Safety & Handling - Read bytes statically; treat strings as untrusted data. ## Workflow ### Step 1: Confirm it is Go and get the version ```bash python scripts/analyst.py info sample.bin ``` Looks for the `Go build ID`, the `go1.x` version string, and `runtime.` references. ### Step 2: Recover function names from pclntab The pclntab (preceded by a magic like `\xfb\xff\xff\xff`/`\xf0\xff\xff\xff` across Go versions) contains function name strings; extract `main.*`, package-qualified, and `runtime.*` names. ### Step 3: Enumerate package paths List embedded import/module paths (`github.com/...`, vendored deps) to fingerprint capabilities and third-party libraries. ### Step 4: Map and document Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK. ## Validation - The Go build signature/version is confirmed before deeper parsing. - Recovered names include plausible `main.*`/package-qualified functions. - Package paths are real module paths, not random strings. ## Pitfalls - pclntab magic differs across Go versions; try the known set. - Obfuscators (garble) rename symbols and strip build info — names may be hashed. - Confusing vendored library code with the author's `main` package. ## References - See [`references/api-reference.md`](references/api-reference.md) for the analyzer. - Go pclntab/buildinfo references (linked in frontmatter).