Ethical Hacking Academy · Lesson

Static Analysis

Strings and headers.

Static Analysis is a free Ethical Hacking Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Static Analysis?

Static analysis examines a malware sample without running it. You inspect the file's contents, structure, and metadata to learn what it might do.

It is safer than running unknown code and is usually the first step in any malware investigation.

Work Safely

Even static analysis should happen in an isolated environment: a dedicated analysis VM with no sensitive data, ideally with networking disabled.

Never analyze malware on your primary machine. Accidental execution or a malicious archive could compromise it.

Hashing the Sample

First, compute the file's hash (MD5, SHA-1, SHA-256). The hash is a fingerprint used to identify the sample and look it up in threat intelligence databases.

Submitting just the hash to VirusTotal avoids uploading the sample itself.

sha256sum sample.exe

Extracting Strings

The strings command pulls printable text from a binary. It can reveal URLs, IP addresses, file paths, registry keys, and error messages.

These artifacts hint at the malware's capabilities and command-and-control infrastructure.

strings -n 8 sample.exe | less

Identifying File Type

Do not trust the file extension. Use file (and inspect magic bytes) to confirm the real format.

A Windows executable starts with MZ (the PE format), an ELF Linux binary starts with 0x7F ELF. Knowing the type guides the rest of the analysis.

file sample.exe
# sample.exe: PE32 executable (GUI) Intel 80386

PE Headers

Windows executables use the Portable Executable (PE) format. The headers describe sections, the entry point, and timestamps.

Tools like PEview, pefile, or PE-bear parse this structure for you.

import pefile
pe = pefile.PE('sample.exe')
print(pe.FILE_HEADER.TimeDateStamp)

Imports and the IAT

The Import Address Table (IAT) lists the API functions the program calls from other DLLs. This is one of the richest sources of behavioral clues.

Imports like InternetOpenUrl, CreateProcess, or RegSetValue suggest networking, execution, and persistence.

Sections and Entropy

PE files are divided into sections like .text (code), .data, and .rsrc (resources).

High entropy in a section often signals packing or encryption, hinting that the real code is hidden until runtime.

Few Strings, Few Imports?

If a sample has very few readable strings and almost no imports, it is likely packed. Packed malware unpacks itself in memory at runtime.

This tells you static analysis alone will not reveal everything; you will need dynamic analysis and unpacking later.

YARA Rules

YARA rules describe patterns of strings or bytes to classify and detect malware families. Running a sample against a rule set can quickly identify known threats.

Analysts also write custom rules from artifacts they find during static analysis.

yara malware_rules.yar sample.exe

Documenting Findings

Throughout static analysis, record every artifact: hashes, suspicious strings, imports, and section anomalies. These become IOCs and inform your next steps.

Good notes also let you correlate the sample with known families and avoid repeating work if you revisit it later.

Quick Check

Recall what high section entropy usually indicates.

Recap

You now understand static malware analysis:

Examine a sample without running it, in an isolated VM.
Compute hashes, extract strings, and confirm the file type.
Parse PE headers, imports (IAT), and sections; high entropy hints at packing.
Use YARA to classify known families.

Next you will watch malware behave with dynamic analysis.

Frequently asked questions

Is the “Static Analysis” lesson free?

Yes — the full text of “Static Analysis” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Static Analysis”?

Strings and headers. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Static Analysis” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy