Static Malware Analysis
PE Structure and Import Resolution

01 / Static vs Dynamic Analysis

Static analysis involves examining a malicious payload without executing it. While dynamic analysis (running the malware in a sandbox) provides immediate behavioral indicators, static analysis allows us to understand the binary's internal structure, capabilities, and potentially extract indicators of compromise (IoCs) that dynamic analysis might miss if the malware detects the sandbox environment.

By dissecting the Portable Executable (PE) format, analyzing entropy, and extracting strings, we can gather significant intelligence before the first instruction is ever executed.

02 / PE File Format

The PE format is the standard executable format for Windows. Understanding its structure is paramount for reverse engineering Windows malware. The structure begins with the DOS header, followed by the NT headers, section headers, and the sections themselves.

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

The OptionalHeader contains critical information, such as the Address of Entry Point (OEP), which is often modified by packers to point to their stub rather than the original program code.

03 / Section Entropy Analysis

Entropy measures the randomness of data within a section, typically on a scale from 0 to 8. High entropy (e.g., > 7.0) often indicates packed or encrypted data, as natural code and data have recognizable patterns.

By examining section entropy, we can quickly identify if a binary is packed. For instance, a .text section with an entropy of 7.9 is highly suspicious. Tools like PEiD or pestudio calculate these values automatically.

pestudio output snippet:
Section: .text
Entropy: 7.942 (Packed)
Raw Size: 0x4000
Virtual Size: 0x12000

04 / Import Table Reconstruction

The Import Address Table (IAT) lists the external functions the binary relies on. Malware analysts use the IAT to infer capabilities. For example, imports like InternetOpen, VirtualAllocEx, and CreateRemoteThread suggest networking and process injection capabilities.

Packers typically destroy or obfuscate the original IAT. Reconstructing it (using tools like Scylla) is a critical step in unpacking malware, restoring the binary to a state where static analysis is viable again.

05 / String Extraction

Strings often contain hardcoded IP addresses, domains, registry keys, and file paths. Extracting them is a low-effort, high-reward technique.

$ strings -a suspicious.exe | grep -E "(http|https)://"
http://malicious-c2-server.com/payload.bin
https://api.telegram.org/bot

06 / YARA Rule Writing

YARA is the "pattern matching swiss knife" for malware researchers. We can encode the insights gained from static analysis into rules to detect similar samples.

rule Detect_Suspicious_Strings {
    meta:
        description = "Detects known C2 strings"
        author = "Atul Govind"
    strings:
        $c2 = "http://malicious-c2-server.com" ascii wide
        $api = "CreateRemoteThread" ascii
    condition:
        uint16(0) == 0x5A4D and all of them
}

07 / Toolchain Summary

A robust static analysis toolchain integrates multiple utilities to parse, disassemble, and pattern-match the binary. Mastery of these tools is essential for modern malware analysis.

Tools Used

Practice Questions

1. Why might a malware author intentionally fragment the PE headers?
2. How do you distinguish between high entropy caused by packing versus high entropy from encrypted resources?
3. Write a YARA rule to detect a PE file that imports VirtualAllocEx and has an entry point outside the .text section.