We can use the Dis-assembler in this application too to check for the Hex Values, and PE header and the header string as we did with HxD application.

Next, You can Drag the malware sample into Exeinfo PE launcher to check additional details like whether its packed or not, and we can check for the sections also, i will explain you about this sections and all in a bit don’t worry. Next to that string, there it goes the PE header that’s where Portable Executable header Starts. Then like I said we can clearly see the Header text contains a string saying “This program cannot be run in DOS mode”. Password will be infectedĪs we know the first step in Static analysis will be the File type identification, we will be doing this will a couple of tools, named as HxD, Exeinfo PE.ĭrag your sample file into HxD launcher, then we can go further with it, you can clearly see that the file type is Portable Executable because the first two bit 00 and 01 clearly indicates it is having 4D 5A as i said in my previous blogs, if you select M in Decoded text then bit 00 will be selected. Your Windows will look like this once you restarted your system.ĭownload and extract the samples that i have given my git hub link. You will get to know how to install FlareVM packages in to windows operating system in it. If You are new here, I request you to complete my previous blogs on Malware analysis here.

Its always advisable to use the malware files in compressed and protected format, The Password to decompress the file is infected.įire up your Malware analysis Operating system which we have have indulge it with the FlareVM distributions and packages. I have uploaded the sample Malware Files in this link, you can download it from here. Hey Everyone, today we will be learning how to analyse Basic simple Malware sample by using Static analysis.

What is pestudio