𝗕𝗮𝗰𝗵𝗲𝗹𝗼𝗿'𝘀 𝗧𝗵𝗲𝘀𝗶𝘀 - Università degli Studi del Sannio Designed and developed an automated malware analysis pipeline to detect undisclosed, potentially harmful behaviours in trusted software (𝗴𝗼𝗼𝗱𝘄𝗮𝗿𝗲) - a critical problem in the context of 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘀𝘂𝗽𝗽𝗹𝘆 𝗰𝗵𝗮𝗶𝗻 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆. Defined a novel classification framework of 𝟭𝟮 𝗘𝗾𝘂𝗶𝘃𝗼𝗰𝗮𝗹 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗕𝗲𝗵𝗮𝘃𝗶𝗼𝘂𝗿𝘀 (𝗘𝗦𝗕𝘀) mapped to the MITRE ATT&CK Enterprise Matrix, covering techniques such as 𝘀𝘆𝘀𝘁𝗲𝗺 𝗿𝗲𝗰𝗼𝗻𝗻𝗮𝗶𝘀𝘀𝗮𝗻𝗰𝗲, 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗺𝗮𝗻𝗶𝗽𝘂𝗹𝗮𝘁𝗶𝗼𝗻, 𝗱𝗲𝗳𝗲𝗻𝗰𝗲 𝗲𝘃𝗮𝘀𝗶𝗼𝗻, and 𝗰𝗼𝘃𝗲𝗿𝘁 𝗺𝗲𝗱𝗶𝗮 𝗰𝗮𝗽𝘁𝘂𝗿𝗲. Built a Python-based orchestration tool with an 𝗮𝘀𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗼𝘂𝘀, 𝗺𝘂𝗹𝘁𝗶𝘁𝗵𝗿𝗲𝗮𝗱𝗲𝗱 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 that automated parallel binary submissions to multiple commercial and open-source sandboxes via REST APIs: - 𝗛𝘆𝗯𝗿𝗶𝗱 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 (Falcon Sandbox) - static + dynamic analysis on Windows 10/11 - 𝗩𝗶𝗿𝘂𝘀𝗧𝗼𝘁𝗮𝗹 - integrated with CAPA (Mandiant/FLARE), CAPE, and ZENBOX - 𝗔𝗡𝗬.𝗥𝗨𝗡 - real-time interactive detonation with PCAP and memory dump collection Analysed 𝟯𝟲 𝗴𝗼𝗼𝗱𝘄𝗮𝗿𝗲 𝗯𝗶𝗻𝗮𝗿𝗶𝗲𝘀 across 𝟲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗰𝗮𝘁𝗲𝗴𝗼𝗿𝗶𝗲𝘀. Results revealed that 𝟭𝟬𝟬% of samples exhibited covert reconnaissance and OS-level exploitation behaviours (ESB1, ESB6), demonstrating that widely trusted software, including major browsers and streaming platforms, silently performs actions consistent with malware TTPs in the absence of vendor-declared 𝗦𝗕𝗢𝗠𝘀 (Software Bill of Materials). Data post-processing and ESB mapping performed with Pandas and Seaborn in Jupyter Notebooks.