agentsclimarketplace

Analyzing malicious iso and container files

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-iso-and-container-files

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-iso-and-container-files

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, as published. Nobody here has run it

Analyzing Malicious ISO and Container Files

When to Use

  • You have an ISO/IMG/VHD attachment suspected of smuggling a payload (LNK + hidden DLL/EXE/script) past MOTW and scanners.
  • You need to enumerate contents and flag hidden/executable entries without mounting the image.

Do not use mounting/auto-run to inspect — that can trigger the lure. Parse the container's directory records statically.

Prerequisites

  • The container file (read inertly). Optional: pycdlib for full ISO parsing (the script falls back to signature/string carving if absent).

Safety & Handling

  • Never mount or open the container interactively; carve statically. Defang any URLs found.

Workflow

Step 1: Identify the container type

python scripts/analyst.py inspect sample.iso

Detects ISO 9660 (CD001), UDF, FAT/VHD signatures and reports the format.

Step 2: Enumerate entries and flag payloads

Lists embedded file signatures (MZ, PK, LNK \x4C\x00\x00\x00, script headers) and flags hidden/executable/decoy entries.

Step 3: Assess the lure chain

A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document the relationship.

Step 4: Extract and route

Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.

Validation

  • The container format is identified by signature.
  • Hidden executables/LNKs/scripts are enumerated with offsets.
  • The lure→payload relationship is documented.

Pitfalls

  • Mounting the image and triggering the lure.
  • Missing payloads in less-common container formats (VHDX, UDF) without the right parser.
  • Overlooking hidden-attribute files that the file manager would not show.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.