domains / families / security / performing-static-malware-analysis-with-pe-studio

performing-static-malware-analysis-with-pe-studio

separate

Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.

When to use

• A suspicious Windows executable has been collected and needs initial triage before sandbox execution
• You need to identify imports, strings, and resources that reveal malware functionality without running the sample
• Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques
• Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary
• Classifying a sample's capabilities based on its import table and section characteristics

When not to use

• dynamic behavioral analysis requiring execution

Skill page

Source