Awesome Static Windows Malware Analysis

   

📖 Contents

• Static Malware Analysis Steps
  • 1. Scanning with Anti-malware
  • 2. Extract Strings
  • 3. Detect Packed and Obfuscated Malware
  • 4. Extraction Linked Libraries and Functions
• Exercises
• My Other Awesome Lists
• Contributing
• Contributors

Static Malware Analysis Steps

1. Step Scanning with Anti-malware

When initially analyzing suspected malware, a recommended first step is to scan the sample using multiple antivirus engines, as it may have already been identified and classified. Services such as VirusTotal are particularly useful for this purpose, as they aggregate results from numerous security vendors in a single platform.

Get-FileHash -Path "C:\path\to\your\file.exe" -Algorithm MD5
Get-FileHash -Path "C:\path\to\your\file.exe" -Algorithm SHA256
Get-FileHash -Path "C:\path\to\your\file.exe" -Algorithm SHA1

2. Step Extract Strings

String extraction is a critical step in static malware analysis because it allows you to quickly gain insight into a binary without executing it.

strings -n 4 C:\path\to\your\file.exe

• n 4 = minimum string length
• Sysinternals's strings supports ASCII + Unicode search

Category	Examples	What It Reveals
Network Indicators	URLs, IP addresses, domain names	Command-and-control (C2) servers, exfiltration targets
File System Activity	File paths, filenames, temp directories	Dropped files, persistence locations
Registry Keys	HKCU\Software...\Run	Auto-start and persistence mechanisms
Command Execution	cmd.exe, powershell, net user	Actions performed by the executable
API Functions	CreateFile, VirtualAlloc, WinExec	Capabilities (file I/O, memory, execution)
Error/Debug Messages	"Failed to connect", "Injection successful"	Execution flow, developer intent
Credentials/Keys	Passwords, encryption keys, tokens	Authentication or encryption mechanisms
Malware Identifiers	Mutex names, campaign IDs, version strings	Malware family classification and tracking

3. Step Detect Packed and Obfuscated Malware

Malware authors commonly use packing and obfuscation techniques to hinder detection and analysis. Obfuscation conceals the program’s true behavior, while packed malware—typically compressed—further restricts static analysis. Both techniques significantly reduce the effectiveness of traditional analysis methods.

Tools

4. Step Extraction Linked Libraries and Functions

Note: In Windows, static, runtime, and dynamic linking refer to how a program incorporates and uses external libraries (DLLs). Static linking includes all required library code directly within the executable at compile time, resulting in a larger file but no external dependencies at runtime. Dynamic linking (load-time linking) occurs when the program references shared libraries (DLLs) that are loaded by the operating system when the application starts, allowing code reuse and smaller executables. Runtime linking (also called explicit linking) happens when a program loads a DLL manually during execution using functions like LoadLibrary and GetProcAddress, which provides greater flexibility and is often used by malware to hide or delay functionality.

• You can find more details at the link.

5. Step

Exercises

• You can find the exercise solutions for the "Practical Malware Analysis" book at this link.

My Other Awesome Lists

You can access the my other awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

License

🔼 Back to top