What sections exist? (name, writeable, executable) How many A/V scanners flagged this file as malware? What level 1 or level 2 indicators did PEStudio identify in this file? Is this a 32-bit or 64-bit PE executable? Populate the following table using information from PEStudio: Question Is there a suspicious lack of any strings at all?įor additional information on the capabilities of PEStudio, see PeStudio Standard.What strings (ASCII and UNICODE) exist in the file?.Is there a suspicious lack of system calls?.Which of those are commonly used in malware?.What system libraries does the binary import?.Does the binary use Structured Exception Handling (SEH)?.What resources does the binary contain? Do any items in the resource section match common file types? (EXE, DLL, ZIP, JAR, etc.).Are the section names abnormal or unique in any way?.Are any code sections suspiciously marked as read-write- execute? Perhaps malware will unpack a payload there.What is their entropy? (might indicate compressed code).What code sections exist in the binary?.

Does VirusTotal and its AV scanners think it's malware?.What indicators might potentially indicate this file is malware?.It can quickly show you many pieces of useful information, such as: PEStudio (from ) is a great tool for initial assessment of an unknown piece of software.

Upload to the Lab 2 Assignment on Canvas when finished. Copy and Paste the table structure so all submissions have roughly-similar formatting for grading. DeliverablesĬreate a PDF document that provides the requested information for each tool below. Go to the course Canvas site and download 4 samples from the Lab 2 Assignment into your Windows or Linux virtual machine as needed depending on the tools specified below. Before proceeding further, take a snapshot of your fresh, non-infected Windows virtual machine and give it a clear label so that you can restore it later when needed.

Pestudio malware