Static Malware Analysis Tools

I’ll describe a few of the tools I frequently use when analyzing malware samples in this article.

Malware analysis is essential in cyber security for several reasons:

1. Detecting and identifying malware: Malware is designed to evade detection and analysis by security tools. Malware analysis helps to identify the presence of malware, determine its behavior, and classify it by types, such as Trojan, virus, worm, or ransomware.
2. Understanding the malware’s capabilities: Malware analysis provides insights into the malware’s capabilities and how it functions. This information is crucial in developing effective countermeasures against malware.
3. Identifying the source of the malware: Malware analysis can help to identify the source of the malware, whether it’s an individual or an organized group. This information is critical for law enforcement and intelligence agencies to track down and prosecute cybercriminals.

Therefore, malware analysis expertise is crucial if you want to advance your career as a cybersecurity specialist. Guess what, malware analysis is more than submitting the files to the Virus total.

TrIDNet

Despite being an older utility, TrIDNet is still widely used. TrIDNet is undoubtedly required if you are working on a file and are unsure of its type. Are you working on .doc, .zip, .exe or you don’t know? You can see what kind of file it is using in this application. All you gotta do is, attach the file to TrIDNet.

https://mark0.net/soft-tridnet-e.html

Exeinfo PE

Exeinfo PE is another awesome tool to analyze malware. This tool has something different than TrIDNet. When you submit your suspicious file to Exeinfo PE, this tool will tell you what kind of file that is and also if this suspicious file has been packed or unpacked. If malware is packed, that means you need to unpack it. Exeinfo PE might tell you which technique you need to use for unpacking.

In this case, it declares the malware is not packed, so you are good to go, with the Lamer Info.

In the second example, we see that malware is packed. BINGO! Exeinfo PE is helping us with what kind of unpack technique we are going to use.

GitHub — ExeinfoASL/ASL: Free Windows Software

PE studio

Of course, the PE studio is the most well-liked entity in this field. If you want to analyze malware without running it, PE studio is a fantastic tool. A lot of helpful information, such as “indicators, libraries, and imports,” can be found in PE Studio. Also, one essential element for malware investigation is string analysis, which PE Studio may assist you with. When I analyze a malware , I usually start from “Strings, imports, libraries and indicators part”

https://www.winitor.com/download

Detect it Easy

DIE as known as Detect it Easy.DIE can give you a lot of details about your malware sample. For example, hash and string values also Hex values. Entry point might be usefull if you would go for manuel unpacking. I usually use this tool to see malware is packed or not packed. After you make a submission , there is button called “Entropy” after you click this botton , you will see the “Status”.

GitHub — horsicq/Detect-It-Easy: Program for determining types of files for Windows, Linux and MacOS.

Thanks for reading. Please like it if you find it useful.