---
name: analyzing-malware-with-ghidra
description: Reverse engineer a suspicious binary in Ghidra — load and auto-analyze the
  sample, recover functions and strings, identify packing, and annotate the decompiled
  control flow to extract behavior and IOCs.
domain: cybersecurity
subdomain: reverse-engineering
tags:
- malware
- reverse-engineering
- ghidra
---

# Analyzing Malware with Ghidra

Import the sample, run auto-analysis, then triage the entry point, imported APIs, and strings. Look for unpacking stubs, anti-analysis checks, and network/file IOCs in the decompiled output. Use scripts/run.py to batch-export the symbol table.