Slash Command

/analyze-binary

Analyzes suspicious binary file using remote Ghidra tools: extracts metadata, performs static and behavioral analysis, detects malware indicators, outputs Markdown report with threat assessment and recommendations.

security

npx claudepluginhub DeepBitsTechnology/claude-plugins --plugin drbinary-chat-plugin

Prompt Preview

# Binary File Analysis

Analyze a suspicious binary file using the remote MCP server's Ghidra analysis tools.

## Usage

Provide the full path to the suspicious file you want to analyze.

## Analysis Process
### Step 1: Ghidra Analysis
Perform:

1. **Basic File Information**
   - File size and type
   - PE header analysis
   - Compilation timestamp
   - Hash values (MD5, SHA256)

2. **Static Analysis**
   - Decompile key functions
   - Extract strings
   - Analyze imports (API calls)
   - Examine exports
   - Review sections (.text, .data, .rsrc)

3. **Behavioral Analysis**
   - Identify su...

Command Content

Other plugins with /analyze-binary

/decompile

4.3k

Decompiles Android APK/XAPK/JAR/AAR files using jadx or Fernflower, installs dependencies if needed, and analyzes structure including AndroidManifest.xml.

6 tools

android-reverse-engineering

/investigate-sandbox

Investigates ZIA Sandbox file analysis issues for MD5 hash or URL, checking reports, quota, SSL inspection rules, and diagnosing blocks, quarantines, or non-analysis. Produces structured diagnosis report.

zscaler

/fire-security-scan

Scans files, directories, skills, plugins, MCP tools, or RAG documents for prompt injection, PII harvesting, credential theft, supply chain attacks, and invisible characters. Supports deep AI analysis, auto-fixes, and report output.

dominion-flow

/analyze-crash

717

Parses and analyzes iOS/macOS crash logs (.ips, .crash, or pasted text) to identify root cause, categorize patterns, and provide actionable next steps.

axiom

/inspect

Inspects a WebAssembly binary in the project and reports its structure, validity, and interfaces using wasm-inspector subagent.

wasm

/analyze

Previews mcp-anything analysis on codebase path, spec file, or API URL as dry run: detects source types/confidence scores, total/sample capabilities. No code generated.

mcp-anything

Stats

Parent Repo Stars19

Parent Repo Forks0

Last CommitNov 6, 2025

Used By2 plugins

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Binary File Analysis

Analyze a suspicious binary file using the remote MCP server's Ghidra analysis tools.

Usage

Provide the full path to the suspicious file you want to analyze.

Analysis Process

Step 1: Ghidra Analysis

Perform:

Basic File Information
- File size and type
- PE header analysis
- Compilation timestamp
- Hash values (MD5, SHA256)
Static Analysis
- Decompile key functions
- Extract strings
- Analyze imports (API calls)
- Examine exports
- Review sections (.text, .data, .rsrc)
Behavioral Analysis
- Identify suspicious API calls
- Check for network capabilities
- Look for file system operations
- Registry manipulation functions
- Process injection techniques
Malware Indicators
- Anti-debugging tricks
- Code obfuscation
- Packing/encryption
- Suspicious behavior patterns

Step 2: Generate Report

Provide comprehensive findings with:

File metadata
Capabilities identified
Malware classification
IoCs (Indicators of Compromise)
Risk assessment
Remediation recommendations

What to Look For

High-Risk API Calls

CreateRemoteThread - Process injection
WriteProcessMemory - Memory manipulation
VirtualAllocEx - Memory allocation in other processes
SetWindowsHookEx - Keylogging capability
URLDownloadToFile - Download additional payloads
Registry functions - Persistence mechanisms
Network functions - C2 communication

Suspicious Patterns

Hardcoded IP addresses
Base64 encoded strings
XOR encryption loops
Anti-VM checks
Sandbox detection
Privilege escalation attempts

Output Format

## Binary Analysis Report

### File Information
- Filename: [name]
- Path: [original path]
- Size: [bytes]
- MD5: [hash]
- SHA256: [hash]
- Type: [PE32/PE64/DLL/etc]

### Analysis Summary
[1-2 paragraph overview]

### Capabilities Detected
- [ ] Network Communication
- [ ] File System Access
- [ ] Registry Modification
- [ ] Process Manipulation
- [ ] Keylogging
- [ ] Screenshot Capture
- [ ] Persistence Mechanism

### Detailed Findings
1. **[Category]**
   - Evidence: [specific code/strings/API calls]
   - Significance: [explanation]
   - Risk: [High/Medium/Low]

### Threat Assessment
- Classification: [Trojan/Adware/RAT/Ransomware/etc]
- Severity: Critical/High/Medium/Low
- Confidence: High/Medium/Low

### Indicators of Compromise
- File hashes
- Mutex names
- Registry keys
- URLs/IPs
- File paths

### Recommendations
1. [Immediate actions]
2. [Remediation steps]
3. [Prevention measures]

Begin the analysis with the provided file path.