Performing Static Malware Analysis with PEStudio

When to Use

• A suspicious Windows executable has been collected and needs initial triage before sandbox execution
• You need to identify imports, strings, and resources that reveal malware functionality without running the sample
• Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques
• Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary
• Classifying a sample's capabilities based on its import table and section characteristics

Do not use for dynamic behavioral analysis requiring execution; use a sandbox (Cuckoo, ANY.RUN) for runtime behavior observation.

Prerequisites

• PEStudio (free edition from https://www.winitor.com/) installed on an isolated analysis workstation
• Python 3.8+ with pefile library for scripted PE analysis (pip install pefile)
• CFF Explorer or PE-bear as supplementary PE analysis tools
• Access to VirusTotal API for hash lookups and community intelligence
• Isolated analysis VM with no network connectivity to production systems
• FLOSS (FireEye Labs Obfuscated String Solver) for extracting obfuscated strings

Workflow

Step 1: Compute File Hashes and Verify Sample Integrity

Generate cryptographic hashes for identification and intelligence lookup:

# Generate MD5, SHA-1, and SHA-256 hashes
md5sum suspect.exe
sha1sum suspect.exe
sha256sum suspect.exe

# Check hash against VirusTotal
curl -s -X GET "https://www.virustotal.com/api/v3/files/$(sha256sum suspect.exe | cut -d' ' -f1)" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# Get file type with magic bytes verification
file suspect.exe

Step 2: Examine PE Headers and Section Table

Open the sample in PEStudio and inspect structural properties:

PEStudio Analysis Points:
━━━━━━━━━━━━━━━━━━━━━━━━━
File Header:       Compilation timestamp, target architecture (x86/x64)
Optional Header:   Entry point address, image base, subsystem (GUI/console)
Section Table:     Section names, virtual/raw sizes, entropy values
                   High entropy (>7.0) in .text/.rsrc suggests packing
Signatures:        Authenticode signature presence and validity

Scripted PE Header Analysis with pefile:

import pefile
import hashlib
import math

pe = pefile.PE("suspect.exe")

# Compilation timestamp
import datetime
timestamp = pe.FILE_HEADER.TimeDateStamp
compile_time = datetime.datetime.utcfromtimestamp(timestamp)
print(f"Compile Time: {compile_time} UTC")

# Section analysis with entropy calculation
for section in pe.sections:
    name = section.Name.decode().rstrip('\x00')
    entropy = section.get_entropy()
    raw_size = section.SizeOfRawData
    virtual_size = section.Misc_VirtualSize
    ratio = virtual_size / raw_size if raw_size > 0 else 0
    print(f"Section: {name:8s} Entropy: {entropy:.2f} Raw: {raw_size:>10} Virtual: {virtual_size:>10} Ratio: {ratio:.2f}")
    if entropy > 7.0:
        print(f"  [!] HIGH ENTROPY - likely packed or encrypted")
    if ratio > 10:
        print(f"  [!] HIGH V/R RATIO - unpacking stub likely present")

Step 3: Analyze Import Address Table (IAT)

Identify suspicious API imports that indicate malware capabilities:

# Extract and categorize imports
suspicious_imports = {
    "Process Injection": ["VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread", "NtCreateThreadEx"],
    "Keylogging": ["GetAsyncKeyState", "SetWindowsHookExA", "GetKeyState"],
    "Persistence": ["RegSetValueExA", "CreateServiceA", "SchTasksCreate"],
    "Evasion": ["IsDebuggerPresent", "CheckRemoteDebuggerPresent", "NtQueryInformationProcess"],
    "Network": ["InternetOpenA", "HttpSendRequestA", "URLDownloadToFileA", "WSAStartup"],
    "File Operations": ["CreateFileA", "WriteFile", "DeleteFileA", "MoveFileA"],
    "Crypto": ["CryptEncrypt", "CryptDecrypt", "CryptAcquireContextA"],
}

for entry in pe.DIRECTORY_ENTRY_IMPORT:
    dll_name = entry.dll.decode()
    for imp in entry.imports:
        if imp.name:
            func_name = imp.name.decode()
            for category, funcs in suspicious_imports.items():
                if func_name in funcs:
                    print(f"[!] {category}: {dll_name} -> {func_name}")

Step 4: Extract and Analyze Strings

Use FLOSS for obfuscated strings and standard strings extraction:

# Standard strings extraction (ASCII and Unicode)

…