analyzing-malware-with-ghidra git:20260920.3643162A

Immutable. This exact content never changes and is served at /api/v1/blob/8f10edfe384be719.

---
name: analyzing-malware-with-ghidra
description: Reverse engineer a suspicious binary in Ghidra — load and auto-analyze the
  sample, recover functions and strings, identify packing, and annotate the decompiled
  control flow to extract behavior and IOCs.
domain: cybersecurity
subdomain: reverse-engineering
tags:
- malware
- reverse-engineering
- ghidra
---

# Analyzing Malware with Ghidra

Import the sample, run auto-analysis, then triage the entry point, imported APIs, and strings. Look for unpacking stubs, anti-analysis checks, and network/file IOCs in the decompiled output. Use scripts/run.py to batch-export the symbol table.