These indicators include 'blacklisted' strings and API calls, as shown below. Perhaps most usefully, PE Studio automatically flags aspects of the file that could indicate that is is malicious, as you can see below. This way, if the attacker changes a portion of the file, hash values of one or more sections might still match as an IOC. For this reason, it's useful to note hash values of the sections that comprise the malicious program. Hash values could be used as indicators of compromise (IOCs), but malware authors can easily tweak the specimen to change the file's hash. You many of these details through other means however, it's very convenient to capture this information on one shot.įor instance, PE Studio not only shows the names and other properties of the PE file's sections, it also automatically computes each section's MD5 hash. PE Studio by Marc Ochsenmeier is a GUI tool for statically examining many aspects of a suspicious Windows executable file, such as imported and exported function names and strings. Let's take a look at a few static analysis utilities that run on Windows. Also, my webcast on getting started with malware analysis using REMnux showed several other Unix-based tools useful for this work. In an earlier post I discussed how to extract static property details a Linux environment by using MASTIFF. Let's take a look at several free Windows tools that are useful for extracting such meta data from potentially-malicious executables. This effort allows you to perform an initial assessment of the file without even infecting a lab system or studying its code. Immediately apply the skills and techniques learned in SANS courses, ranges, and summitsĮxamining static properties of suspicious files is a good starting point for malware analysis.

Pestudio malware analysis