Tools to Perform Static Property Analysis: PE Studio

When conducting malware analysis, it's essential to gather as much information as possible about the malicious program in question. One valuable approach is to perform static property analysis, which allows you to examine the file without executing it or studying its code. This initial assessment can provide a wealth of insights and help you identify potential indicators of compromise (IOCs).

One useful tool for performing static property analysis is PE Studio, developed by Marc Ochsenmeier. This graphical user interface (GUI) tool enables you to examine various aspects of a suspicious Windows executable file, including imported and exported function names, strings, and more. One of its most valuable features is the ability to automatically compute the MD5 hash for each section of the PE file.

Hash values can be used as IOCs, but malware authors may modify their specimens to change the file's hash. However, by capturing these details through other means, you can still gather this information quickly and conveniently. For instance, PE Studio shows the names and properties of the PE file's sections, making it easy to identify potential indicators of compromise.

In addition to PE Studio, there are several other free Windows tools that can help you extract static property details from potentially malicious executables. These utilities allow you to perform an initial assessment of the file without infecting a lab system or studying its code. By applying the skills and techniques learned in SANS courses, ranges, and summits, you can examine the static properties of suspicious files and get started with malware analysis.

Some other Unix-based tools are also useful for this work, as demonstrated in my webcast on getting started with malware analysis using REMnux. For those who prefer to work in a Linux environment, MASTIFF is another tool that can help you extract static property details from suspicious files. By leveraging these tools and techniques, you can perform effective static property analysis and take the first step towards comprehensive malware analysis.

Tools to perform static property analysis pestudio