Malware [02] Static Malware Analysis

Welcome back to our Malware Analysis Series!

In Malware 01, we successfully set up our VM lab for safe malware analysis. Now, it’s time for Malware 02, where we begin static analysis of a suspicious file without executing it.

This blog will cover:

✅ Installing FLARE-VM

✅ Identifying file types & signatures

✅ Generating malware hashes

✅ Extracting and analyzing strings

✅ Inspecting PE headers

✅ Detecting packed malware & unpacking it

Let’s get started!

Step 1: Installing FLARE-VM

FLARE-VM is a Windows-based malware analysis environment packed with security tools.

Follow this link for installation: FLARE-VM GitHub

Installation Steps:

1️ Download the Installer: Right-click installer.ps1 → Save to your FLARE-VM machine.

2️ Open PowerShell as Administrator in that folder.

3️ Run the following commands:

Unblock-File .\install.ps1
Set-ExecutionPolicy Unrestricted -Force
.\install.ps1

Tip: Switch to Host-Only networking mode and take a VM snapshot before working with malware.

Step 2: Getting the Malware Sample

To follow along, download the sample malware file from our GitHub repository: GitHub Link to Malware Sample

Security Warning: Though this sample is the fake one just for analysis purpose, it is best practice to Only analyze malware inside FLARE-VM, and never on your main machine!

Step 3: Identifying the File Type

Before analyzing a file, we need to determine what type of file it is.

a) Why is this important?

Different file types behave differently. A PE file (Windows Executable) is structured with headers, while a script-based malware follows different execution patterns.

b) Where can we check file signatures?

File signatures (also called magic numbers) help determine a file’s true type.

🔗 Reference: Click here to see list of file signatures

Tools:

o HxD (Hex Editor)

o Pestudio

Steps:

1️ Open the file in HxD.

2️ Look at the first few bytes:

4D 5A (‘MZ’) → Confirms it’s a Windows Portable Executable (PE) file.

50 45 (‘PE’) at offset 0x80 → PE header.

Key Takeaways:

· If it’s an EXE or DLL, proceed with PE header analysis.

· If it’s a script, the malware might be Python, JavaScript, or VBA-based.

Step 4: Generating Malware Hashes

Hashes create a unique fingerprint of the file, allowing analysts to:

· Track malware variants.

· Compare against known threats in VirusTotal, ANY.RUN, and Hybrid Analysis.

Tools:

o HashMyFiles

o HashCalc

Steps:

1️ Open HashMyFiles and scan the malware sample.

2 Generate MD5, SHA-1, and SHA-256 hashes.

3️ Copy and check them in VirusTotal(since our file is just for testing purpose, you won’t get info).

Key Takeaways:

· If the hash matches known malware, you’ll find reports from researchers.

· If no match is found, it might be a new or modified variant.

Step 5: Extracting and Analyzing Strings

Malware often contains hardcoded text that reveals:

· IP addresses (command-and-control servers)

· Registry keys (persistence mechanisms)

· API calls (functions used to interact with the system)

Tools:

o Strings Command (PowerShell)

o PEStudio

Steps:

1️ Right-click the file → Choose Strings to extract readable text.

2️ Open PowerShell and run:

strings

strings -a -n 6 path_to_file

(-a = all strings, -n 6 = minimum string length of 6 characters)

Key Takeaways:

· Look for network indicators, API calls, and obfuscated text.

· Some malware uses fake strings to mislead analysts!

Step 6: Inspecting the PE Header

The PE header contains crucial details about the malware’s execution:

✅ Imported libraries & functions (LoadLibrary, WinExec, RegSetValue)

✅ Sections (.text, .data, .rsrc)

✅ Timestamps (may be tampered with to hide its origin)

Tools:

o PEStudio

o Exeinfo PE

o CFF Explorer

Steps:

1️ Open the file in PEStudio.

2️ Look at:

[Note: Practice analyzing real world malware samples in a safe isolated environment for better result ]

· Imports & API Calls → Common malware indicators (ShellExecute, RegCreateKey).

· Sections → .text (code), .rsrc (resources), .reloc (relocations).

· Timestamps → Check if the compilation date seems fake.

Key Takeaways:

· Registry modifications indicate persistence.

· Packed malware might have empty or compressed .text sections.

Step 7: Detecting Packed Malware & Unpacking It

Malware often uses packers to compress code and evade detection.

Tools:

o Exeinfo PE

o UPX

Steps:

1️ Open Exeinfo PE and scan the malware.

2️ If it’s packed with UPX, unpack it:

upx -d fake_malware.exe

3️ Compare before and after unpacking:

· File size difference (unpacking increases size).

· New extracted strings and API calls.

Key Takeaways:

· Packing hides the actual code — unpacking exposes the real payload.

· Always reanalyze the PE header and strings after unpacking.

What’s Next?

o We installed FLARE-VM and prepared our analysis lab.

o We performed static analysis, extracting file details, hashes, and strings.

o We identified packed files and learned how to unpack malware.

🔜 Up Next: Malware [03] — Dynamic Malware Analysis.