analyzing-malware-with-ghidra git:20260630.26f0168A

Immutable. This exact content never changes and is served at /api/v1/blob/51bf547d1eb16712.

---
name: analyzing-malware-with-ghidra
description: Reverse engineer a suspicious binary in Ghidra — load and auto-analyze the
  sample, recover functions and strings, identify packing, and annotate the decompiled
  control flow to extract behavior and IOCs.
domain: cybersecurity
subdomain: reverse-engineering
tags:
- malware
- reverse-engineering
- ghidra
---

# Analyzing Malware with Ghidra

Import the sample, run auto-analysis, then triage the entry point, imported APIs, and
strings. Look for unpacking stubs, anti-analysis checks, and network/file IOCs in the
decompiled output. Use scripts/run.py to batch-export the symbol table.