0Pricing
Cyber Security Academy · Lesson

Static Analysis: Strings, Hashes, and PE Headers

Extract strings, compute hashes, and parse PE headers to characterize malware without running it.

Static Analysis: Strings, Hashes, and PE Headers is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Static Analysis?

Static analysis examines malware without executing it. You extract information from the file itself — strings, imports, headers, and metadata — to understand its capabilities before risking execution.

Computing File Hashes

Hash a sample with MD5, SHA-1, and SHA-256 to create unique fingerprints. Submit hashes to VirusTotal to check detection rates and find related samples without running the file.

sha256sum malware.exe
md5sum malware.exe

Extracting Strings

The strings utility extracts printable ASCII and Unicode text embedded in a binary. Look for URLs, file paths, registry keys, mutex names, and error messages that reveal intent.

strings -n 8 malware.exe | grep -iE "(http|reg|cmd|pass)"

PE File Format Overview

Windows executables use the Portable Executable format. The MZ header, DOS stub, PE signature, COFF header, optional header, and section table all describe how the OS maps the file into memory.

Section Analysis

PE sections like .text (code), .data (initialized data), .rdata (read-only), and .rsrc (resources) reveal structure. High entropy in .text may indicate packing or encryption.

# Using pefile Python library
import pefile
pe = pefile.PE("malware.exe")
for section in pe.sections:
  print(section.Name, section.get_entropy())

Import Address Table (IAT)

The IAT lists every Windows API function the binary imports. Seeing VirtualAlloc, WriteProcessMemory, CreateRemoteThread suggests process injection. WinINet imports imply C2 communication.

Tools: PEStudio and CFF Explorer

PEStudio combines hash checks, string extraction, IAT analysis, and VirusTotal lookup in one GUI. CFF Explorer lets you edit PE headers and inspect resources. Both are free and essential for malware analysis.

Packer Detection

Packed malware hides its true imports behind a stub that unpacks at runtime. Signs: few imports (LoadLibrary + GetProcAddress), high .text entropy, unusual section names like UPX0, or no recognizable code patterns in a disassembler.

FLOSS for Obfuscated Strings

FLOSS (FLARE Obfuscated String Solver) from Mandiant automatically extracts stack-based, decoded, and tight-loop decoded strings that strings misses — greatly improving static coverage of obfuscated samples.

Resource Section Analysis

Malware often stores payloads, configuration files, or PE files inside the .rsrc section. Use Resource Hacker or pecheck to extract and analyze embedded resources for secondary payloads.

Building a Static Analysis Report

Document: sample hash, compile timestamp, linker version, notable imports, suspicious strings, detected packer, resource anomalies, and VirusTotal score. This baseline feeds into dynamic analysis.

Knowledge Check

Which PE section typically contains the executable code of a program?

Summary

Static analysis builds a detailed portrait of malware without running it. Hashes, strings, PE header analysis, IAT inspection, and packer detection together reveal capabilities and guide deeper investigation.

Frequently asked questions

Is the “Static Analysis: Strings, Hashes, and PE Headers” lesson free?

Yes — the full text of “Static Analysis: Strings, Hashes, and PE Headers” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Static Analysis: Strings, Hashes, and PE Headers”?

Extract strings, compute hashes, and parse PE headers to characterize malware without running it. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Static Analysis: Strings, Hashes, and PE Headers” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Static Analysis: Strings, Hashes, and PE Headers
  2. Dynamic Analysis in a Sandbox
  3. Behavioral IOCs: Registry, Network, and File Artifacts
  4. YARA Rules for Malware Detection
← Back to Cyber Security Academy