performing-static-malware-analysis-with-pe-studio

Featured

Performs static analysis of Windows PE (Portable Executable) malware samples using PEStudio to examine file headers, imports, strings, resources, and indicators without executing the binary. Identifies suspicious characteristics including packing, anti-analysis techniques, and malicious imports. Activates for requests involving static malware analysis, PE file inspection, Windows executable analysis, or pre-execution malware triage.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Performing Static Malware Analysis with PEStudio ## When to Use - A suspicious Windows executable has been collected and needs initial triage before sandbox execution - You need to identify imports, strings, and resources that reveal malware functionality without running the sample - Determining whether a PE file is packed, obfuscated, or contains anti-analysis techniques - Extracting indicators of compromise (hashes, URLs, IPs, registry keys) embedded in a binary - Classifying a sample's capabilities based on its import table and section characteristics **Do not use** for dynamic behavioral analysis requiring execution; use a sandbox (Cuckoo, ANY.RUN) for runtime behavior observation. ## Prerequisites - PEStudio (free edition from https://www.winitor.com/) installed on an isolated analysis workstation - Python 3.8+ with `pefile` library for scripted PE analysis (`pip install pefile`) - CFF Explorer or PE-bear as supplementary PE analysis tools - Access to VirusTotal API for hash lookups and community intelligence - Isolated analysis VM with no network connectivity to production systems - FLOSS (FireEye Labs Obfuscated String Solver) for extracting obfuscated strings ## Workflow ### Step 1: Compute File Hashes and Verify Sample Integrity Generate cryptographic hashes for identification and intelligence lookup: ```bash # Generate MD5, SHA-1, and SHA-256 hashes md5sum suspect.exe sha1sum suspect.exe sha256sum suspect.exe # Check hash against VirusTotal curl -s -X GE...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

analyzing-packed-malware-with-upx-unpacker

Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.

12,642 Updated today
mukul975
Data & Documents Listed

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

335 Updated today
aiskillstore
AI & Automation Featured

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.

39,227 Updated today
sickn33
AI & Automation Featured

performing-malware-ioc-extraction

Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist

12,642 Updated today
mukul975
DevOps & Infrastructure Featured

analyzing-linux-elf-malware

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.

12,642 Updated today
mukul975