Static Analysis: Strings, Hashes, and PE Headers
Extract strings, compute hashes, and parse PE headers to characterize malware without running it.
What is Static Analysis?
Static analysis examines malware without executing it. You extract information from the file itself — strings, imports, headers, and metadata — to understand its capabilities before risking execution.
Computing File Hashes
Hash a sample with MD5, SHA-1, and SHA-256 to create unique fingerprints. Submit hashes to VirusTotal to check detection rates and find related samples without running the file.
sha256sum malware.exe
md5sum malware.exeAll lessons in this course
- Static Analysis: Strings, Hashes, and PE Headers
- Dynamic Analysis in a Sandbox
- Behavioral IOCs: Registry, Network, and File Artifacts
- YARA Rules for Malware Detection