PEStudio

One-liner: Free Windows PE (Portable Executable) analysis tool for static malware triage and forensic examination.

🎯 What Is It?

PEStudio is a lightweight, offline static analysis tool for Windows executables (.exe, .dll, .sys). It quickly identifies suspicious indicators in PE files without executing them, making it ideal for initial Malware Analysis triage. Unlike VirusTotal, PEStudio works offline and doesn't upload samples.

Website: https://www.winitor.com/
Cost: Free

🛠️ Key Features

1. Virus Indicator Detection

PEStudio highlights suspicious characteristics:

• 🔴 Red indicators — High confidence malicious
• 🟡 Yellow indicators — Suspicious, needs review
• ⚪ Gray indicators — Neutral

Example Indicators:

🔴 Entropy: 7.8 (packed/encrypted)
🔴 Imported function: VirtualAllocEx (process injection)
🟡 No digital signature
🟡 Unusual section name: .packed
🔴 Writes to registry Run key (persistence)

2. PE Header Analysis

Parses PE structure:

• DOS Header — Legacy compatibility
• PE Header — Architecture (x86/x64), timestamp
• Optional Header — Entry point, image base
• Section Headers — .text, .data, .rsrc

Suspicious Indicators:

• Mismatched headers
• Unusual entry point
• Non-standard section names (.packed, .upx)

3. Import Address Table (IAT)

Lists all imported functions from DLLs.

Malicious Function Examples:

Process Injection:
  - VirtualAllocEx
  - WriteProcessMemory
  - CreateRemoteThread

Keylogging:
  - GetAsyncKeyState
  - SetWindowsHookEx

Persistence:
  - RegSetValueEx
  - CreateServiceW

Network Activity:
  - InternetOpenA
  - HttpSendRequestA
  - WSAStartup

4. Strings Analysis

Extracts embedded strings (similar to strings command).

Look for:

• IPs, domains (C2 servers)
• File paths (C:\Windows\Temp\malware.exe)
• Registry keys (persistence)
• Error messages, debug info
• Suspicious commands (cmd /c del, powershell -enc)

Example:

http://evil-c2.com/beacon
C:\Users\Admin\AppData\update.exe
Software\Microsoft\Windows\CurrentVersion\Run
mimikatz

5. Entropy Analysis

Measures randomness to detect packing/encryption.

Entropy Scale:
0.0 - 4.0 : Low (plain text)
4.0 - 6.0 : Medium (normal code)
6.0 - 7.5 : High (compressed)
7.5 - 8.0 : Very High (encrypted/packed)

Packed malware often has entropy > 7.0 to evade signature detection.

6. Digital Signature Verification

Checks if file is signed by trusted publisher.

✅ Valid Signature: Microsoft Corporation
❌ Invalid Signature: Self-signed, expired, or missing

Unsigned executables from unknown sources = suspicious.

7. Resources

Extracts embedded resources:

• Icons
• Dialogs
• Embedded executables
• Configuration data

Malware often embeds:

• Dropper payloads
• Encrypted C2 configs
• Decoy icons (masquerading as PDFs)

8. Sections Analysis

Reviews PE sections for anomalies.

Normal Sections:

• .text — Executable code
• .data — Initialized data
• .rdata — Read-only data
• .rsrc — Resources

Suspicious Sections:

• .upx, .packed — Packer signatures
• High entropy sections
• Executable .data or .rsrc sections (RWX permissions)

9. VirusTotal Integration

Optional: Submit hash to VirusTotal for online check (requires API key).

📝 Malware Triage Workflow

1. Load suspicious.exe into PEStudio
   ↓
2. Review Indicators tab
   - Check for red/yellow flags
   - High entropy? (Packed?)
   - Suspicious imports? (Injection, keylogging?)
   ↓
3. Check Digital Signature
   - Unsigned or invalid? → Suspicious
   ↓
4. Review Strings
   - C2 domains/IPs?
   - Suspicious commands?
   ↓
5. Analyze Imports
   - Process injection APIs?
   - Credential theft functions?
   ↓
6. Check Sections
   - Packed sections?
   - Unusual section names?
   ↓
7. Submit hash to VirusTotal
   - Already known malware?
   ↓
8. Decision:
   - Benign? → Close ticket
   - Suspicious? → Escalate to Tier 2 / Malware Analysis
   - Malicious? → Incident Response

💡 Example: Analyzing a Suspicious File

File: invoice.exe

PEStudio Analysis:

🔴 Indicators: 12 red, 8 yellow
🔴 Entropy: 7.92 (packed/encrypted)
🔴 No digital signature
🔴 Suspicious imports:
   - VirtualAllocEx
   - WriteProcessMemory
   - CreateRemoteThread
   - InternetOpenA
🔴 Strings found:
   - http://192.0.2.100:8080/beacon
   - C:\Users\Admin\AppData\update.exe
   - HKCU\Software\Microsoft\Windows\CurrentVersion\Run
🟡 Unusual section: .packed (entropy 7.9)

Conclusion: Highly suspicious, likely packed trojan with process injection and C2 communication.

Next Steps:

1. Submit to VirusTotal (by hash)
2. Dynamic analysis in sandbox
3. Block IOCs (IP, file hash)

🆚 PEStudio vs Other Tools

⚠️ What PEStudio Cannot Do

1. Dynamic Analysis — Doesn't execute malware (safe but limited)
2. Unpacking — Detects packing but doesn't unpack
3. Decompilation — No assembly code view (use IDA/Ghidra)
4. Network Simulation — No C2 traffic analysis
5. Multi-Platform — Windows PE only (no Linux ELF, macOS Mach-O)

🔑 Key Shortcuts

Ctrl + O : Open file
Ctrl + S : Export indicators to XML
Ctrl + F : Search strings
F5       : Refresh analysis

📊 Use Case: SOC Triage

Tier 1 Analyst Workflow:
1. Alert: Suspicious .exe downloaded from email
2. Quarantine file
3. Open in PEStudio (offline, safe)
4. 15 red indicators detected
5. Check hash on VirusTotal: 45/70 malicious
6. Extract IOCs (IPs, domains)
7. Escalate to Tier 2 with PEStudio report
8. Block IOCs at firewall

Time: 5-10 minutes

🎤 Interview Angles

Q: What is PEStudio and when would you use it?

• Free static analysis tool for Windows PE files
• Used for quick malware triage without execution
• Identifies suspicious indicators (entropy, imports, strings)
• Ideal for SOC analysts in alert triage
• Offline tool (no opsec concerns like VirusTotal)

Q: How do you identify packed malware with PEStudio?

STAR Example:
Situation: Received suspicious invoice.exe from phishing email.
Task: Determine if file is packed/obfuscated.
Action:

• Opened file in PEStudio
• Checked entropy: 7.92 (very high → packed/encrypted)
• Reviewed sections: .upx section with high entropy
• Imports: VirtualProtect (runtime unpacking indicator)
• No digital signature
  Result: Confirmed packed malware; submitted to dynamic analysis for unpacking and behavioral monitoring.

Q: What suspicious indicators do you look for in PEStudio?

1. High Entropy (>7.0) — Packing/encryption
2. Suspicious Imports:
   • VirtualAllocEx, WriteProcessMemory (injection)
   • GetAsyncKeyState (keylogging)
   • RegSetValueEx (persistence)
3. No Digital Signature — Untrusted origin
4. Unusual Section Names — .packed, .upx
5. Suspicious Strings — C2 IPs, persistence registry keys
6. Mismatched Metadata — Fake version info

🔗 Related Concepts

• [[Malware Analysis]] — Primary use case
• Static Analysis — Analysis type
• [[VirusTotal]] — Complementary online tool
• strings — CLI alternative for string extraction
• [[Incident Response]] — Triage phase
• SOC analysts — Primary users