Malware is often packed so that the code written by the malware author is obfuscated, the bad guys have taken time to write some malicious code and don't want it to be an easy task for somebody to take a quick look at the malware and in a short space of time identify what it does and how to stop it.Įntropy is measured on a scale of 0-8, the higher the value the more likely it is that the malware is packed with values of 7-8 pretty much confirming the sample is packed.

The entropy of the file is also listed, this is useful because the value of the entropy can help identify if the malware is packed or not. However, the operating system recognizes each type of file by the byte pattern in the header, a Windows executable will always begin with �4D 5A' in hex, this equates to the values �MZ' in ASCII. As Windows users, we typically identify a file by the extension appended to the file name i.e. The first bytes in the header of a file will always have the same byte pattern depending on the type of file. This is useful because it is confirming that the file is indeed a Windows Executable. PeStudio also provides the first bytes in hexadecimal, in the image above we can see this is �4D 5A'. Here we are presented with information such as hashes of the sample, if you are dealing with a malware-related incident in your organization you could use this information to start blocking and looking for devices that have these hashes on the filesystem. Upon opening a malware sample in PeStudio the user is presented with the �Main' tab. The user is then presented with a number of tabs that provide varying information that PeStudio has pulled out of the sample Main Tab Double-clicking the desktop icon opens the tool, to start investigating a piece of malware simply drag the malware sample into the tool. What I love about PeStudio is how easy it is to use and the clear, simple layout of the tool. In this article, I will cover what PeStudio is, some of the key features and how you can use it to begin analyzing malware. This is great for the initial triage of a malware sample. It provides so much information about the sample and gives me a wealth of information for me to start building out my report. Whenever I begin analysing a piece of malware, I will always load it into PeStudio first. PeStudio is a tool used for statically analyzing malware and is one of my favourite tools for malware analysis.

Pestudio github