Forensic Investigation Tools
PEStudio Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
PEStudio Introduction
PEStudio is a software analysis tool designed to inspect and analyze executable files on the Windows operating system. PE stands for "Portable Executable," which is the file format used for executable files, DLLs (Dynamic Link Libraries), and other Windows executable modules. PEStudio specifically focuses on providing insights into the characteristics and behavior of these files.
Overall, PEStudio is a valuable tool for security professionals, malware analysts, and forensic experts who need to assess the security posture of executable files and identify potential threats within the Windows environment.
Some uses of PEStudio summarises
- Malware Analysis: PEStudio is commonly used in cybersecurity and malware analysis to examine executable files for signs of malicious behavior. It can identify suspicious patterns, code anomalies, and other indicators that might suggest the presence of malware.
- Static Analysis: The tool performs static analysis on executable files without executing them. This includes examining the file's metadata, such as import and export functions, resource information, and header details.
- Indicators of Compromise (IoC): PEStudio helps identify potential Indicators of Compromise (IoC) by looking for known patterns or signatures associated with malware or malicious activities. It checks the file against various databases and signatures to highlight potential risks.
- File Integrity Checks: PEStudio can verify the integrity of files by comparing them against digital signatures and hash values. This helps ensure that files have not been tampered with or corrupted.
- Dependency Analysis: The tool provides insights into the dependencies of an executable, including DLLs and imported functions. This information is valuable for understanding how the file interacts with the system and other components.
- Graphical Visualization: PEStudio offers a graphical representation of the relationships between different components within an executable, making it easier for analysts to understand the file's structure.
- YARA Rule Integration: YARA is a tool for pattern matching in files or data streams. PEStudio can integrate YARA rules, allowing users to define custom rules for detecting specific patterns or behaviors in analyzed files.
- Risk Assessment: PEStudio provides a risk assessment score based on the analysis of various characteristics. This score can help analysts quickly evaluate the potential risk associated with a particular executable.
Using PEStudio
This is an extremely powerful tool to use but it requires some knowledge to make full use of all the functionality. Here I just show what I use the tool for. Open the tool if you have downloaded it Download Page
Once open, you can drag any file that you might want to analyse. The tool will offer multiple views of the file including hex and ASCII. I normally start by checking the virus total results. So I right click on virus total, if there is an error I open it in the browser from the options that come.
In this case the browser results showed that a number of antivirus vendors found this file to be malicious. Virus total is a great resource for checking what multiple vendors think about a file and this could help you find malware that your antivirus misses.
The tool allows you to inspect the directories it uses, what it imports from the system, any digital certificate of the file and much more. All of these tools can be quite handy in the hands of a skilled malware hunter.
