PE2Prompt: a large language model-native framework for interpretable static malware analysis

Large Language Models (LLMs) possess strong general-purpose reasoning abilities, yet their integration into static malware analysis pipelines remains limited due to the representational gap between high-dimensional numerical features and the natural-language input format required for inference. This study introduces PE2Prompt, a Large Language Model-native framework for interpretable and industrially deployable static malware analysis. PE2Prompt formalizes a modular process that bridges numeric Portable Executable (PE) features and LLM reasoning through three key components: (1) LLM-guided feature curation directly from raw EMBER JSON fields to identify semantically relevant attributes; (2) numerical feature summarization, compressing byte-histogram and entropy distributions into interpretable descriptors; and (3) structured prompt construction, transforming curated PE semantics into language-based reasoning templates. We evaluate zero-shot and few-shot prompting across GPT-4o-mini, Claude 3.7 Sonnet, and DeepSeek-Chat, analyzing classification accuracy, recall asymmetry, latency, and inference cost under varying feature-selection thresholds. GPT-4o-mini achieves the most balanced performance (≈ 83 % accuracy) with minimal computational overhead, while Claude attains higher malicious recall but increased false positives, and DeepSeek-Chat exhibits unstable prediction behavior. Beyond empirical performance, PE2Prompt establishes a reproducible methodology for integrating LLM reasoning within static malware workflows, defining a new feature-to-language reasoning paradigm that advances explainable, adaptable, and zero-retraining malware analysis for industrial cybersecurity environments.