Malware Analysis and Detection Portfolio

This repository is a collection of technical malware analysis reports, extracted indicators of compromise (IOCs), and detection rules. It includes samples analyzed during the Practical Malware Analysis & Triage (PMAT) course, such as the WannaCry ransomware, alongside additional trojans and malscripts analyzed through personal research.

Environment and Tooling

All samples are handled and detonated within a segregated, isolated lab network using the following stack:

• Analysis Platforms: Windows 10 (FLARE VM) and REMnux
• Network Simulation: INetSim and Wireshark
• Static Inspection: Ghidra, PEStudio, PEView, FLOSS, Capa, VirusTotal, MobSF
• Dynamic Telemetry: Sysinternals (Procmon, Autoruns, TCPView), x64dbg, Ncat
• Detection Engineering: YARA

Repository Structure

The project is organized by sample name. Each folder contains the technical analysis report (.docx) along with associated detection rules (.yara).