portable-executable-analysis

Portable Executable (PE) Analysis

When to Use

• You receive a suspicious attachment (.exe, .dll, .scr) and need to verify if it is malicious without infecting a sandbox.
• When conducting static malware triage to determine the file's capabilities (e.g., does it have networking functions? Keylogging functions?).
• When trying to identify if a binary is "packed" (obfuscated/compressed) to evade antivirus signatures.
• To extract hardcoded Configuration Data, C2 (Command and Control) IP addresses, or Bitcoin wallets from ransomware or trojans.

Prerequisites

• Isolated analysis environment (VM with snapshot capability)
• Sample file safely obtained and handled with appropriate precautions
• PE analysis tools (PE-bear, CFF Explorer, Detect It Easy) installed
• Disassembler/decompiler (Ghidra, IDA Free, or Binary Ninja) configured

Workflow

Phase 1: File Identification & Hashing

# Concept: Always identify the actual file type, as malware authors often disguise 
# executables with fake extensions (e.g., invoice.pdf.exe).

# 1. Generate Hashes to cross-reference with VirusTotal or Threat Intelligence
md5sum suspicious_file.bin
sha256sum suspicious_file.bin

# 2. Check the real file type using magic bytes
file suspicious_file.bin
# Output expected: PE32 executable (GUI) Intel 80386, for MS Windows
# Keep an eye out for UPX compressed warnings or unexpected compiled languages (.NET, Go).

Phase 2: String Extraction & Obfuscation Checks

# Concept: Malware contains hardcoded text (API names, error messages, IPs).
# Extracting them statically is the fastest way to understand a program's intent.

# 1. Standard string extraction (ASCII and Unicode)
strings -a suspicious_file.bin > strings_ascii.txt
strings -el suspicious_file.bin > strings_unicode.txt

# 2. Search for common malicious patterns:
grep -i "http\|https\|ftp\|www" strings_ascii.txt      # Look for C2 domains
grep -i "cmd.exe\|powershell\|vssadmin" strings_ascii.txt # Look for execution / shadow copy deletion
grep -i "CurrentVersion\\Run" strings_ascii.txt        # Look for persistence mechanisms

# 3. Use FLOSS (FireEye Labs Obfuscated String Solver)
# If strings output is garbage, the strings are likely encoded (XOR'd) or packed.
# FLOSS automatically deobfuscates standard encryption routines statically.
floss suspicious_file.bin > deobfuscated_strings.txt