Basic Static Malware Analysis

1. Identify File type

The file command in Kali Linux is a utility used to determine the type of a file by examining its content and providing information about its format. It helps identify the file's data type, such as whether it is a text file, an image, an executable binary, or an archive

file myfile.txt

Windows Utilities

Get the first few hex bytes using following software and then match it to check the file type from the reference sites.

Hxd Hex Editor

HxD - Freeware Hex Editor and Disk Editor | mh-nexusmh-nexus.de

Exeinfo PE

http://www.exeinfo.byethost18.com/?i=1www.exeinfo.byethost18.com

PE Studio

winitor.comwww.winitor.com

A very good tool to perform most of the actions

CFF explorer

Explorer SuiteNTCore

Reference for identifying file types

GCK File Signatures, Powered by SEARCHwww.garykessler.net

2. Identify File Signature

VirusTotalVirusTotal

Free Automated Malware Analysis Service - powered by Falcon Sandboxwww.hybrid-analysis.com

3. Obfuscation/ Packing

To hide the code from antiviruses and Analysis

Entropy is the main indication of packing. It involves mostly measuring bits.

measured from 1-8

4. Strings

Tools

• PE Studio (let you organize by size and hints)

• strings

Other Useful tools

olevba. Analysis Macros in office documents.

olevbaGitHub

Sandboxes

Interactive Online Malware Analysis Sandbox - ANY.RUNapp.any.run

online very good