How to use Codex to extract malware evidence

Joshua McKiddy used Codex skills for defensive reverse-engineering triage in a FLARE-VM environment. He tested two playbooks across four malware samples: one produced a packing assessment and unpacking plan, while the other produced an evidence-backed IOC table and YAML artifact.

The first runs gathered hashes, file types and strings before searching for candidate indicators. Tool availability, Windows quoting and fragile one-line commands caused problems, so McKiddy refined the workflow toward simple searches and predictable artifacts. Every retained indicator needed an exact local evidence line.

That boundary mattered when certificate URLs appeared with trailing junk. The output labelled incomplete or uncertain strings instead of guessing clean endpoints or enriching them from outside sources. Packing assessment also separated statically understandable samples from one that required further investigation.

The unpacking playbook paused if execution became necessary, leaving the engineer to approve a controlled next step. The result was repeatable static reports and structured evidence, not automatic detonation or completed unpacking of every sample. McKiddy describes portability and consistent handoff artifacts as the improvement, with analyst review and explicit gaps remaining part of the workflow.

Prompt
Suggested prompt (written by Agents In Use, not the author's)

Source: Personal research blog · Joshua McKiddy