Static Malware Analysis
what is Static Analysis?
Static malware analysis is the process of examining malicious files without executing them, helping researchers identify threats safely. It involves checking file hashes , extracting readable strings, analyzing imports and API calls , detecting obfuscation, and disassembling code . This method is useful for detecting known malware, understanding its structure, and identifying potential threats, but it can't reveal runtime behavior like network communication or code injection. To get a full picture, static analysis is often combined with dynamic analysis.
Information that can be found during Static Malware Analysis
File Metadata — File type (EXE, DLL, PDF, etc.), hashes (MD5, SHA-256), compile timestamps, and embedded metadata.
Readable Strings — Hardcoded URLs, IP addresses, error messages, filenames, encryption keys, API keys, and registry paths.
Imported Functions & API Calls — Windows API calls (e.g., file manipulation, process injection, network access, encryption functions).
Embedded Configuration — C2 server addresses, botnet commands, persistence mechanisms, and execution parameters.
Packing & Obfuscation Indicators — Signs of compression, encryption, or polymorphic code used to evade detection.
Code Structure & Disassembly — Low-level assembly instructions, function calls, and possible exploits used.
Embedded Resources — Hidden payloads, images, decoy documents, shellcode, or additional malware components.
Persistence Mechanisms — Auto-start registry entries, scheduled tasks, DLL hijacking attempts, or startup folder modifications.
Anti-Analysis Techniques — Debugging checks, sandbox evasion tricks, and virtual machine detection methods.
Embedded Scripts & Macros — Malicious VBA macros (in Office files), JavaScript, PowerShell commands, or shell scripts used for execution.
How to perform Static Analysis and tools used for it
Before performing static analysis take a snapshot of the machine so that you can revert back to it.
Detect It Easy (DIE) is a lightweight file analysis tool that helps identify file types, including executable and non-executable formats, by examining their headers and metadata
From Detect It Easy we can see that it is a PE32 type file. with entry point. It is the starting address in the code section of a program where the processor begins executing instructions
HxD is a free, hex editor tool that allows users to view and edit binary data in files, including raw hexadecimal and ASCII representations.
We can see that it starts with 4D 5A header. It is the signature of a Windows Portable Executable (PE) file, commonly known as the “MZ” header
Get Dante’s stories in your inbox
Join Medium for free to get updates from this writer.
File Hash is a tool used to find the hash values of the file
here we got the MD5, SHA256, SHA512 hashes
The Strings tool is used to extract readable text, such as ASCII or Unicode strings, from binary files, including executables and malware.
Here we can see that it is Trying to encrypt the types of files in User directory and create a READ_IT.txt file in Desktop.
Here we can see the wallet address.
Floss (FireEye Labs Obfuscated String Solver) is a tool used to automatically extract obfuscated strings from malware samples. It helps analysts decode and retrieve hidden or encrypted strings that may indicate malicious activity, such as URLs, IP addresses, or command-and-control server information.
CFF Explorer is a Windows-based tool used for analyzing and editing Portable Executable (PE) files, such as executables and DLLs. It provides detailed insights into the PE file structure, allowing users to examine headers, sections, and resources, making it valuable for reverse engineering and malware analysis.
Shows the windows api function used by the program and other details.
Here we found mscoree.dll being used. It suggests that the malware may be leveraging the .NET Framework to execute its payload. This DLL is commonly used to load and run .NET-based code in a Windows environment.
Static Analysis Findings
- File Type: Portable Executable (PE) file (MZ signature).
- Hashes: Identified file hashes (MD5, SHA-1, SHA-256) for identification and comparison.
- Type of Malware: Ransomware, which encrypts files to demand ransom.
- Wallet Address: Associated cryptocurrency wallet address for ransom payment.
- Files Encrypted: Targets common file types such as
.docx,.xlsx,.pdf,.jpg etc from Users directory - Windows APIs Used: Utilizes mscoree.dll
