[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG30PDJMKYYNDAHHB9WJ2D":3,"skill-same:01M6AG30PDJMKYYNDAHHB9WJ2D":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AG30PDJMKYYNDAHHB9WJ2D","performing-static-malware-analysis-with-pe-studio",null,"Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-static-malware-analysis-with-pe-studio\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing static malware analysis with pe studio","analysis","malware","malware analysis","static-analysis","PEStudio","PE-analysis","execution","packing","malware-analysis","reverse-engineering","malicious","engineering","file","windows","triage","cybersecurity","static analysis","sandbox","suspicious","2026-11-10 10:12:30",false,"---\nname: performing-static-malware-analysis-with-pe-studio\ndescription: >-\n  Performs static analysis of Windows PE malware samples using PEStudio to\n  examine file headers, imports, strings, and resources without executing\n  the binary, identifying packing, anti-analysis tricks, and malicious\n  imports. Use for pre-execution triage of a suspicious Windows executable\n  before sandbox detonation.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- static-analysis\n- PE-analysis\n- PEStudio\n- reverse-engineering\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T0816\n---\n\n# Performing Static Malware Analysis with PEStudio\n\n## When to Use\n\n- A suspicious Windows executable has been collected and needs initial triage before sandbox execution\n- You need to identify imports, strings, and resources that reveal malware functionality without running the sample\n- Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques\n- Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary\n- Classifying a sample's capabilities based on its import table and section characteristics\n\n**Do not use** for dynamic behavioral analysis requiring execution; use a sandbox (Cuckoo, ANY.RUN) for runtime behavior observation.\n\n## Prerequisites\n\n- PEStudio (free edition from https:\u002F\u002Fwww.winitor.com\u002F) installed on an isolated analysis workstation\n- Python 3.8+ with `pefile` library for scripted PE analysis (`pip install pefile`)\n- CFF Explorer or PE-bear as supplementary PE analysis tools\n- Access to VirusTotal API for hash lookups and community intelligence\n- Isolated analysis VM with no network connectivity to production systems\n- FLOSS (FireEye Labs Obfuscated String Solver) for extracting obfuscated strings\n\n## Workflow\n\n### Step 1: Compute File Hashes and Verify Sample Integrity\n\nGenerate cryptographic hashes for identification and intelligence lookup:\n\n```bash\n# Generate MD5, SHA-1, and SHA-256 hashes\nmd5sum suspect.exe\nsha1sum suspect.exe\nsha256sum suspect.exe\n\n# Check hash against VirusTotal\ncurl -s -X GET \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$(sha256sum suspect.exe | cut -d' ' -f1)\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Get file type with magic bytes verification\nfile suspect.exe\n```\n\n### Step 2: Examine PE Headers and Section Table\n\nOpen the sample in PEStudio and inspect structural properties:\n\n```\nPEStudio Analysis Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nFile Header:       Compilation timestamp, target architecture (x86\u002Fx64)\nOptional Header:   Entry point address, image base, subsystem (GUI\u002Fconsole)\nSection Table:     Section names, virtual\u002Fraw sizes, entropy values\n                   High entropy (>7.0) in .text\u002F.rsrc suggests packing\nSignatures:        Authenticode signature presence and validity\n```\n\n**Scripted PE Header Analysis with pefile:**\n```python\nimport pefile\nimport hashlib\nimport math\n\npe = pefile.PE(\"suspect.exe\")\n\n# Compilation timestamp\nimport datetime\ntimestamp = pe.FILE_HEADER.TimeDateStamp\ncompile_time = datetime.datetime.utcfromtimestamp(timestamp)\nprint(f\"Compile Time: {compile_time} UTC\")\n\n# Section analysis with entropy calculation\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00')\n    entropy = section.get_entropy()\n    raw_size = section.SizeOfRawData\n    virtual_size = section.Misc_VirtualSize\n    ratio = virtual_size \u002F raw_size if raw_size > 0 else 0\n    print(f\"Section: {name:8s} Entropy: {entropy:.2f} Raw: {raw_size:>10} Virtual: {virtual_size:>10} Ratio: {ratio:.2f}\")\n    if entropy > 7.0:\n        print(f\"  [!] HIGH ENTROPY - likely packed or encrypted\")\n    if ratio > 10:\n        print(f\"  [!] HIGH V\u002FR RATIO - unpacking stub likely present\")\n```\n\n### Step 3: Analyze Import Address Table (IAT)\n\nIdentify suspicious API imports that indicate malware capabilities:\n\n```python\n# Extract and categorize imports\nsuspicious_imports = {\n    \"Process Injection\": [\"VirtualAllocEx\", \"WriteProcessMemory\", \"CreateRemoteThread\", \"NtCreateThreadEx\"],\n    \"Keylogging\": [\"GetAsyncKeyState\", \"SetWindowsHookExA\", \"GetKeyState\"],\n    \"Persistence\": [\"RegSetValueExA\", \"CreateServiceA\", \"SchTasksCreate\"],\n    \"Evasion\": [\"IsDebuggerPresent\", \"CheckRemoteDebuggerPresent\", \"NtQueryInformationProcess\"],\n    \"Network\": [\"InternetOpenA\", \"HttpSendRequestA\", \"URLDownloadToFileA\", \"WSAStartup\"],\n    \"File Operations\": [\"CreateFileA\", \"WriteFile\", \"DeleteFileA\", \"MoveFileA\"],\n    \"Crypto\": [\"CryptEncrypt\", \"CryptDecrypt\", \"CryptAcquireContextA\"],\n}\n\nfor entry in pe.DIRECTORY_ENTRY_IMPORT:\n    dll_name = entry.dll.decode()\n    for imp in entry.imports:\n        if imp.name:\n            func_name = imp.name.decode()\n            for category, funcs in suspicious_imports.items():\n                if func_name in funcs:\n                    print(f\"[!] {category}: {dll_name} -> {func_name}\")\n```\n\n### Step 4: Extract and Analyze Strings\n\nUse FLOSS for obfuscated strings and standard strings extraction:\n\n```bash\n# Standard strings extraction (ASCII and Unicode)\nstrings -a suspect.exe > strings_ascii.txt\nstrings -el suspect.exe > strings_unicode.txt\n\n# FLOSS for decoded\u002Fdeobfuscated strings\nfloss suspect.exe --output-json floss_output.json\n\n# Search for network indicators in strings\ngrep -iE \"(http|https|ftp):\u002F\u002F\" strings_ascii.txt\ngrep -iE \"([0-9]{1,3}\\.){3}[0-9]{1,3}\" strings_ascii.txt\ngrep -iE \"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\" strings_ascii.txt\n\n# Search for registry keys\ngrep -i \"HKLM\\\\|HKCU\\\\|SOFTWARE\\\\|CurrentVersion\\\\Run\" strings_ascii.txt\n\n# Search for file paths and extensions\ngrep -iE \"\\.(exe|dll|bat|ps1|vbs|tmp)\" strings_ascii.txt\n```\n\n### Step 5: Inspect Resources and Embedded Data\n\nExamine the PE resource section for embedded payloads or configuration:\n\n```python\n# Extract resources from PE file\nif hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):\n    for resource_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:\n        if hasattr(resource_type, 'directory'):\n            for resource_id in resource_type.directory.entries:\n                if hasattr(resource_id, 'directory'):\n                    for resource_lang in resource_id.directory.entries:\n                        data = pe.get_data(resource_lang.data.struct.OffsetToData,\n                                          resource_lang.data.struct.Size)\n                        entropy = calculate_entropy(data)\n                        print(f\"Resource Type: {resource_type.id} Size: {len(data)} Entropy: {entropy:.2f}\")\n                        if entropy > 7.0:\n                            print(f\"  [!] High entropy resource - possible embedded payload\")\n                        # Check for PE signature in resource (embedded executable)\n                        if data[:2] == b'MZ':\n                            print(f\"  [!] Embedded PE detected in resource\")\n                            with open(f\"extracted_resource_{resource_type.id}.bin\", \"wb\") as f:\n                                f.write(data)\n```\n\n### Step 6: Check for Packing and Protection\n\nDetermine if the binary is packed or protected:\n\n```bash\n# Detect packer with Detect It Easy (DIE)\ndiec suspect.exe\n\n# Check with PEiD signatures (command-line version)\npython3 -c \"\nimport pefile\npe = pefile.PE('suspect.exe')\n# Check for common packer section names\npacker_sections = {'.upx0': 'UPX', '.aspack': 'ASPack', '.adata': 'ASPack',\n                   '.nsp0': 'NsPack', '.vmprotect': 'VMProtect', '.themida': 'Themida'}\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00').lower()\n    if name in packer_sections:\n        print(f'[!] Packer detected: {packer_sections[name]} (section: {name})')\n\n# Check import table size (very few imports suggest packing)\nimport_count = sum(len(entry.imports) for entry in pe.DIRECTORY_ENTRY_IMPORT)\nif import_count \u003C 10:\n    print(f'[!] Only {import_count} imports - likely packed')\n\"\n```\n\n### Step 7: Generate Static Analysis Report\n\nCompile all findings into a structured triage report:\n\n```\nDocument the following for each analyzed sample:\n- File identification (hashes, file type, size, compile timestamp)\n- Packing\u002Fprotection status and identified packer\n- Suspicious imports categorized by capability\n- Network indicators extracted from strings (IPs, domains, URLs)\n- Embedded resources and their characteristics\n- Overall threat assessment and recommended next steps (sandbox execution, YARA rule creation)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PE (Portable Executable)** | The file format for Windows executables (.exe, .dll, .sys) containing headers, sections, imports, and resources that define how the OS loads the binary |\n| **Import Address Table (IAT)** | PE structure listing external DLL functions the executable calls at runtime; reveals program capabilities and intent |\n| **Section Entropy** | Statistical measure of randomness in a PE section; values above 7.0 (out of 8.0) indicate compression, encryption, or packing |\n| **FLOSS** | FireEye Labs Obfuscated String Solver; automatically extracts and decodes obfuscated strings that standard `strings` misses |\n| **Packing** | Compression or encryption of a PE file's code section to hinder static analysis; requires runtime unpacking stub to execute |\n| **PE Resources** | Data section within a PE file that can contain icons, dialogs, version info, or attacker-embedded payloads and configuration data |\n| **Compilation Timestamp** | Timestamp in the PE header indicating when the binary was compiled; can be forged but often reveals development timeline |\n\n## Tools & Systems\n\n- **PEStudio**: Free Windows tool for static analysis of PE files providing indicators, imports, strings, and resource inspection in a single interface\n- **pefile (Python)**: Python library for parsing and analyzing PE file structures programmatically for automated analysis pipelines\n- **FLOSS**: FireEye tool that extracts obfuscated strings from malware using static analysis techniques including stack string decoding\n- **Detect It Easy (DIE)**: Packer and compiler detection tool that identifies protectors, compilers, and linkers used to build PE files\n- **CFF Explorer**: Advanced PE editor and viewer for detailed inspection of PE headers, sections, imports, and resource directories\n\n## Common Scenarios\n\n### Scenario: Triaging a Suspicious Email Attachment\n\n**Context**: SOC receives an alert on a suspicious executable attached to a phishing email. The file needs rapid triage to determine if it is malicious before committing sandbox resources.\n\n**Approach**:\n1. Compute SHA-256 hash and query VirusTotal for existing detections and community comments\n2. Open in PEStudio and check the indicators tab for red\u002Fyellow flagged items\n3. Verify compile timestamp (future dates or dates from 1970 indicate timestamp manipulation)\n4. Check imports for VirtualAllocEx, CreateRemoteThread (injection), URLDownloadToFileA (downloader)\n5. Extract strings and search for C2 URLs, IP addresses, and file paths\n6. Check resources for embedded PE files or high-entropy data blobs\n7. Assess packing status; if packed, note the packer and plan for unpacking before deeper analysis\n\n**Pitfalls**:\n- Trusting the PE compile timestamp without corroborating evidence (timestamps are trivially forged)\n- Concluding a file is benign because it has few suspicious imports (packed malware hides real imports)\n- Missing Unicode strings by only running ASCII string extraction\n- Not checking overlay data appended after the last PE section (common hiding spot for configuration data)\n\n## Output Format\n\n```\nSTATIC MALWARE ANALYSIS REPORT\n=================================\nSample:           suspect.exe\nMD5:              d41d8cd98f00b204e9800998ecf8427e\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        245,760 bytes\nFile Type:        PE32 executable (GUI) Intel 80386\nCompile Time:     2025-09-14 08:23:15 UTC\n\nPACKING STATUS\nPacker Detected:  None (native binary)\nSection Entropy:  .text=6.42 .rdata=4.89 .data=3.21 .rsrc=7.81\nNote:             .rsrc section entropy elevated - check resources\n\nSUSPICIOUS IMPORTS\n[INJECTION]       kernel32.dll -> VirtualAllocEx\n[INJECTION]       kernel32.dll -> WriteProcessMemory\n[INJECTION]       kernel32.dll -> CreateRemoteThread\n[EVASION]         kernel32.dll -> IsDebuggerPresent\n[NETWORK]         wininet.dll  -> InternetOpenA\n[NETWORK]         wininet.dll  -> HttpSendRequestA\n[PERSISTENCE]     advapi32.dll -> RegSetValueExA\n\nEXTRACTED INDICATORS\nURLs:             hxxps:\u002F\u002Fupdate.malicious[.]com\u002Fgate.php\nIPs:              185.220.101[.]42, 91.215.85[.]17\nRegistry Keys:    HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost\nFile Paths:       C:\\Users\\Public\\svchost.exe\n\nEMBEDDED RESOURCES\nResource 101:     Size=98304 Entropy=7.89 [!] Embedded PE detected\nResource 102:     Size=4096  Entropy=2.14 (configuration XML)\n\nASSESSMENT\nThreat Level:     HIGH\nClassification:   Dropper with process injection capabilities\nRecommended:      Execute in sandbox, extract embedded PE for separate analysis\n```\n","# Performing Static Malware Analysis with PEStudio\n\n## When to Use\n\n- A suspicious Windows executable has been collected and needs initial triage before sandbox execution\n- You need to identify imports, strings, and resources that reveal malware functionality without running the sample\n- Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques\n- Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary\n- Classifying a sample's capabilities based on its import table and section characteristics\n\n**Do not use** for dynamic behavioral analysis requiring execution; use a sandbox (Cuckoo, ANY.RUN) for runtime behavior observation.\n\n## Prerequisites\n\n- PEStudio (free edition from https:\u002F\u002Fwww.winitor.com\u002F) installed on an isolated analysis workstation\n- Python 3.8+ with `pefile` library for scripted PE analysis (`pip install pefile`)\n- CFF Explorer or PE-bear as supplementary PE analysis tools\n- Access to VirusTotal API for hash lookups and community intelligence\n- Isolated analysis VM with no network connectivity to production systems\n- FLOSS (FireEye Labs Obfuscated String Solver) for extracting obfuscated strings\n\n## Workflow\n\n### Step 1: Compute File Hashes and Verify Sample Integrity\n\nGenerate cryptographic hashes for identification and intelligence lookup:\n\n```bash\n# Generate MD5, SHA-1, and SHA-256 hashes\nmd5sum suspect.exe\nsha1sum suspect.exe\nsha256sum suspect.exe\n\n# Check hash against VirusTotal\ncurl -s -X GET \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$(sha256sum suspect.exe | cut -d' ' -f1)\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Get file type with magic bytes verification\nfile suspect.exe\n```\n\n### Step 2: Examine PE Headers and Section Table\n\nOpen the sample in PEStudio and inspect structural properties:\n\n```\nPEStudio Analysis Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nFile Header:       Compilation timestamp, target architecture (x86\u002Fx64)\nOptional Header:   Entry point address, image base, subsystem (GUI\u002Fconsole)\nSection Table:     Section names, virtual\u002Fraw sizes, entropy values\n                   High entropy (>7.0) in .text\u002F.rsrc suggests packing\nSignatures:        Authenticode signature presence and validity\n```\n\n**Scripted PE Header Analysis with pefile:**\n```python\nimport pefile\nimport hashlib\nimport math\n\npe = pefile.PE(\"suspect.exe\")\n\n# Compilation timestamp\nimport datetime\ntimestamp = pe.FILE_HEADER.TimeDateStamp\ncompile_time = datetime.datetime.utcfromtimestamp(timestamp)\nprint(f\"Compile Time: {compile_time} UTC\")\n\n# Section analysis with entropy calculation\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00')\n    entropy = section.get_entropy()\n    raw_size = section.SizeOfRawData\n    virtual_size = section.Misc_VirtualSize\n    ratio = virtual_size \u002F raw_size if raw_size > 0 else 0\n    print(f\"Section: {name:8s} Entropy: {entropy:.2f} Raw: {raw_size:>10} Virtual: {virtual_size:>10} Ratio: {ratio:.2f}\")\n    if entropy > 7.0:\n        print(f\"  [!] HIGH ENTROPY - likely packed or encrypted\")\n    if ratio > 10:\n        print(f\"  [!] HIGH V\u002FR RATIO - unpacking stub likely present\")\n```\n\n### Step 3: Analyze Import Address Table (IAT)\n\nIdentify suspicious API imports that indicate malware capabilities:\n\n```python\n# Extract and categorize imports\nsuspicious_imports = {\n    \"Process Injection\": [\"VirtualAllocEx\", \"WriteProcessMemory\", \"CreateRemoteThread\", \"NtCreateThreadEx\"],\n    \"Keylogging\": [\"GetAsyncKeyState\", \"SetWindowsHookExA\", \"GetKeyState\"],\n    \"Persistence\": [\"RegSetValueExA\", \"CreateServiceA\", \"SchTasksCreate\"],\n    \"Evasion\": [\"IsDebuggerPresent\", \"CheckRemoteDebuggerPresent\", \"NtQueryInformationProcess\"],\n    \"Network\": [\"InternetOpenA\", \"HttpSendRequestA\", \"URLDownloadToFileA\", \"WSAStartup\"],\n    \"File Operations\": [\"CreateFileA\", \"WriteFile\", \"DeleteFileA\", \"MoveFileA\"],\n    \"Crypto\": [\"CryptEncrypt\", \"CryptDecrypt\", \"CryptAcquireContextA\"],\n}\n\nfor entry in pe.DIRECTORY_ENTRY_IMPORT:\n    dll_name = entry.dll.decode()\n    for imp in entry.imports:\n        if imp.name:\n            func_name = imp.name.decode()\n            for category, funcs in suspicious_imports.items():\n                if func_name in funcs:\n                    print(f\"[!] {category}: {dll_name} -> {func_name}\")\n```\n\n### Step 4: Extract and Analyze Strings\n\nUse FLOSS for obfuscated strings and standard strings extraction:\n\n```bash\n# Standard strings extraction (ASCII and Unicode)\nstrings -a suspect.exe > strings_ascii.txt\nstrings -el suspect.exe > strings_unicode.txt\n\n# FLOSS for decoded\u002Fdeobfuscated strings\nfloss suspect.exe --output-json floss_output.json\n\n# Search for network indicators in strings\ngrep -iE \"(http|https|ftp):\u002F\u002F\" strings_ascii.txt\ngrep -iE \"([0-9]{1,3}\\.){3}[0-9]{1,3}\" strings_ascii.txt\ngrep -iE \"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}\" strings_ascii.txt\n\n# Search for registry keys\ngrep -i \"HKLM\\\\|HKCU\\\\|SOFTWARE\\\\|CurrentVersion\\\\Run\" strings_ascii.txt\n\n# Search for file paths and extensions\ngrep -iE \"\\.(exe|dll|bat|ps1|vbs|tmp)\" strings_ascii.txt\n```\n\n### Step 5: Inspect Resources and Embedded Data\n\nExamine the PE resource section for embedded payloads or configuration:\n\n```python\n# Extract resources from PE file\nif hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE'):\n    for resource_type in pe.DIRECTORY_ENTRY_RESOURCE.entries:\n        if hasattr(resource_type, 'directory'):\n            for resource_id in resource_type.directory.entries:\n                if hasattr(resource_id, 'directory'):\n                    for resource_lang in resource_id.directory.entries:\n                        data = pe.get_data(resource_lang.data.struct.OffsetToData,\n                                          resource_lang.data.struct.Size)\n                        entropy = calculate_entropy(data)\n                        print(f\"Resource Type: {resource_type.id} Size: {len(data)} Entropy: {entropy:.2f}\")\n                        if entropy > 7.0:\n                            print(f\"  [!] High entropy resource - possible embedded payload\")\n                        # Check for PE signature in resource (embedded executable)\n                        if data[:2] == b'MZ':\n                            print(f\"  [!] Embedded PE detected in resource\")\n                            with open(f\"extracted_resource_{resource_type.id}.bin\", \"wb\") as f:\n                                f.write(data)\n```\n\n### Step 6: Check for Packing and Protection\n\nDetermine if the binary is packed or protected:\n\n```bash\n# Detect packer with Detect It Easy (DIE)\ndiec suspect.exe\n\n# Check with PEiD signatures (command-line version)\npython3 -c \"\nimport pefile\npe = pefile.PE('suspect.exe')\n# Check for common packer section names\npacker_sections = {'.upx0': 'UPX', '.aspack': 'ASPack', '.adata': 'ASPack',\n                   '.nsp0': 'NsPack', '.vmprotect': 'VMProtect', '.themida': 'Themida'}\nfor section in pe.sections:\n    name = section.Name.decode().rstrip('\\x00').lower()\n    if name in packer_sections:\n        print(f'[!] Packer detected: {packer_sections[name]} (section: {name})')\n\n# Check import table size (very few imports suggest packing)\nimport_count = sum(len(entry.imports) for entry in pe.DIRECTORY_ENTRY_IMPORT)\nif import_count \u003C 10:\n    print(f'[!] Only {import_count} imports - likely packed')\n\"\n```\n\n### Step 7: Generate Static Analysis Report\n\nCompile all findings into a structured triage report:\n\n```\nDocument the following for each analyzed sample:\n- File identification (hashes, file type, size, compile timestamp)\n- Packing\u002Fprotection status and identified packer\n- Suspicious imports categorized by capability\n- Network indicators extracted from strings (IPs, domains, URLs)\n- Embedded resources and their characteristics\n- Overall threat assessment and recommended next steps (sandbox execution, YARA rule creation)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PE (Portable Executable)** | The file format for Windows executables (.exe, .dll, .sys) containing headers, sections, imports, and resources that define how the OS loads the binary |\n| **Import Address Table (IAT)** | PE structure listing external DLL functions the executable calls at runtime; reveals program capabilities and intent |\n| **Section Entropy** | Statistical measure of randomness in a PE section; values above 7.0 (out of 8.0) indicate compression, encryption, or packing |\n| **FLOSS** | FireEye Labs Obfuscated String Solver; automatically extracts and decodes obfuscated strings that standard `strings` misses |\n| **Packing** | Compression or encryption of a PE file's code section to hinder static analysis; requires runtime unpacking stub to execute |\n| **PE Resources** | Data section within a PE file that can contain icons, dialogs, version info, or attacker-embedded payloads and configuration data |\n| **Compilation Timestamp** | Timestamp in the PE header indicating when the binary was compiled; can be forged but often reveals development timeline |\n\n## Tools & Systems\n\n- **PEStudio**: Free Windows tool for static analysis of PE files providing indicators, imports, strings, and resource inspection in a single interface\n- **pefile (Python)**: Python library for parsing and analyzing PE file structures programmatically for automated analysis pipelines\n- **FLOSS**: FireEye tool that extracts obfuscated strings from malware using static analysis techniques including stack string decoding\n- **Detect It Easy (DIE)**: Packer and compiler detection tool that identifies protectors, compilers, and linkers used to build PE files\n- **CFF Explorer**: Advanced PE editor and viewer for detailed inspection of PE headers, sections, imports, and resource directories\n\n## Common Scenarios\n\n### Scenario: Triaging a Suspicious Email Attachment\n\n**Context**: SOC receives an alert on a suspicious executable attached to a phishing email. The file needs rapid triage to determine if it is malicious before committing sandbox resources.\n\n**Approach**:\n1. Compute SHA-256 hash and query VirusTotal for existing detections and community comments\n2. Open in PEStudio and check the indicators tab for red\u002Fyellow flagged items\n3. Verify compile timestamp (future dates or dates from 1970 indicate timestamp manipulation)\n4. Check imports for VirtualAllocEx, CreateRemoteThread (injection), URLDownloadToFileA (downloader)\n5. Extract strings and search for C2 URLs, IP addresses, and file paths\n6. Check resources for embedded PE files or high-entropy data blobs\n7. Assess packing status; if packed, note the packer and plan for unpacking before deeper analysis\n\n**Pitfalls**:\n- Trusting the PE compile timestamp without corroborating evidence (timestamps are trivially forged)\n- Concluding a file is benign because it has few suspicious imports (packed malware hides real imports)\n- Missing Unicode strings by only running ASCII string extraction\n- Not checking overlay data appended after the last PE section (common hiding spot for configuration data)\n\n## Output Format\n\n```\nSTATIC MALWARE ANALYSIS REPORT\n=================================\nSample:           suspect.exe\nMD5:              d41d8cd98f00b204e9800998ecf8427e\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        245,760 bytes\nFile Type:        PE32 executable (GUI) Intel 80386\nCompile Time:     2025-09-14 08:23:15 UTC\n\nPACKING STATUS\nPacker Detected:  None (native binary)\nSection Entropy:  .text=6.42 .rdata=4.89 .data=3.21 .rsrc=7.81\nNote:             .rsrc section entropy elevated - check resources\n\nSUSPICIOUS IMPORTS\n[INJECTION]       kernel32.dll -> VirtualAllocEx\n[INJECTION]       kernel32.dll -> WriteProcessMemory\n[INJECTION]       kernel32.dll -> CreateRemoteThread\n[EVASION]         kernel32.dll -> IsDebuggerPresent\n[NETWORK]         wininet.dll  -> InternetOpenA\n[NETWORK]         wininet.dll  -> HttpSendRequestA\n[PERSISTENCE]     advapi32.dll -> RegSetValueExA\n\nEXTRACTED INDICATORS\nURLs:             hxxps:\u002F\u002Fupdate.malicious[.]com\u002Fgate.php\nIPs:              185.220.101[.]42, 91.215.85[.]17\nRegistry Keys:    HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svchost\nFile Paths:       C:\\Users\\Public\\svchost.exe\n\nEMBEDDED RESOURCES\nResource 101:     Size=98304 Entropy=7.89 [!] Embedded PE detected\nResource 102:     Size=4096  Entropy=2.14 (configuration XML)\n\nASSESSMENT\nThreat Level:     HIGH\nClassification:   Dropper with process injection capabilities\nRecommended:      Execute in sandbox, extract embedded PE for separate analysis\n```\n",{"name":5,"tags":49,"author":50,"domain":40,"license":15,"version":51,"nist_csf":52,"subdomain":33,"description":7,"mitre_attack":57},[26,28,30,29,34],"mahipal","1.0.0",[53,54,55,56],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[58,59,60,61,62],"T1027","T1055","T1140","T1497","T0816","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-static-malware-analysis-with-pe-studio",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-static-malware-analysis-with-pe-studio",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-static-malware-analysis-with-pe-studio",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-static-malware-analysis-with-pe-studio","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-static-malware-analysis-with-pe-studio\u002FSKILL.md",true,[87,92,98,102,106],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-static-malware-analysis-with-pe-studio\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2176,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-static-malware-analysis-with-pe-studio\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fargocd-setup.md",2894,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fgitops-workflow\u002Freferences\u002Fargocd-setup.md",{"path":103,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fsync-policies.md",2767,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fgitops-workflow\u002Freferences\u002Fsync-policies.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7978,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-static-malware-analysis-with-pe-studio\u002Fscripts\u002Fagent.py",[113,140,164,192,217,244],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,125,40,126,127,128,129,130,131,132,133,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,136,149,150,125,151,40,128,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,173],{"categoryNo":171,"categoryName":172,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,175,176,177,178,40,179,180,152,181,182,183,184,185,186,187,188,189,190,191],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[38,200,201,40,202,203,204,205,206,207,208,209,210,211,212,213,155,214,215,216],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,40,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[125,252,40,253,37,254,255,256,257,258,259,187,31,188,25,260,261,262,263,264],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]