Automating Malware Reverse Engineering with Local LLMs, PyGhidra and Neo4j Graphs

A researcher has built an automated system that combines PyGhidra, Neo4j and a local large language model to speed up the initial analysis of malicious binaries. The project addresses the main drawbacks of sending decompiled code to cloud LLMs: leakage of indicators of compromise, possible censorship of sensitive modules, and rapid context overflow when a sample contains 100–200 functions.

Architecture and data flow

The pipeline begins with ghidra_extractor.py, which uses PyGhidra to disassemble and decompile a binary without launching the Ghidra GUI. For every function the extractor records its address, name, size, cyclomatic complexity, decompiled C pseudocode (truncated at 6000 characters with a 30-second timeout), call-graph neighbors, string references and imported API calls. Metadata such as PE format, architecture and all standard file hashes are also stored. All extracted entities are loaded into Neo4j as distinct node types: Sample, Function, String, Import, Analysis, Capability and Behavior.

Next, worker.py and mcp.py iterate over functions and send each one to a locally hosted Qwen3 model running inside LM Studio. The prompt includes both the decompiled code and the function’s position in the call graph, allowing the model to understand caller-callee relationships. The model returns structured JSON describing the function’s purpose, extracted IOCs, tags, network indicators, command-line usage and anti-analysis techniques.

aggregator.py then aggregates tags across all functions into Capability nodes that carry a strength weight reflecting how often each capability appears. builder.py combines these capabilities with the call graph to detect higher-level behavioral patterns such as file encryption combined with network activity. Finally, generator.py produces a human-readable report by querying the enriched graph.

Graph data model

Storing functions in a flat table makes it difficult to answer questions such as whether five anti-debug functions call one another. In the Neo4j model a Function node is connected to other Function nodes via CALLS edges, to String nodes via REFERENCES edges, and to Import nodes via USES edges. Capability and Behavior nodes sit above the function level and are linked through weighted relationships, enabling concise Cypher queries instead of recursive joins.

Validation on WannaCry

The pipeline was tested on a WannaCry sample obtained from MalwareBazaar. Processing 195 functions took 126 minutes on a machine with 60 GB RAM and an Nvidia 5070 Ti. The generated report identified three behavioral patterns with 100 percent confidence: File Encryption (supported by 40 functions), C2 Communication and Anti-Analysis. A publicly available YARA rule confirmed the anti-debug findings discovered by the system.

The complete source code is available in the repository Dvoranchik/MLMalwareAnalyzer. Future work will focus on refining call-graph traversal and prompt engineering to surface additional indicators.