## Static Analysis\n\nAnalyzing malware without running it.\n\n### File Properties\n\n```bash\n# Calculate hashes\nmd5sum malware.exe\nsha256sum malware.exe\n\n# File type identification\nfile malware.exe\n```\n\n### String Analysis\n\n```bash\nstrings -n 6 malware.exe | grep -E "(http|https|\\.[a-z]{2,4}$)"\n\n# FLOSS for obfuscated strings\nfloss malware.exe\n```\n\n**What to look for**:\n- URLs and IP addresses\n- Registry keys\n- File paths\n- Crypto wallet addresses\n- Debug messages\n- Encryption keys\n\n### PE Header Analysis\n\n**Tools**: PEStudio, PE-bear, pefile (Python)\n\n**Examine**:\n- Compile timestamp\n- Imports (what Windows APIs?)\n- Sections (.text, .data, unusual names)\n- Resources (embedded files, icons)\n- Digital signatures\n\n### Import Analysis\n\nSuspicious imports indicate capabilities:\n\n| API | Likely Purpose |\n|-----|----------------|\n| CreateRemoteThread | Code injection |\n| VirtualAllocEx | Memory manipulation |\n| WriteProcessMemory | Process hollowing |\n| RegSetValueEx | Persistence |\n| InternetOpenUrl | C2 communication |\n| CryptEncrypt | Encryption/ransomware |\n\n### Packing Detection\n\nMany malware samples are packed (compressed/encrypted):\n\n```\n# High entropy (>7.0) suggests packing\n# UPX, Themida, custom packers\n```\n\n**Tools**: Detect It Easy (DIE), ExeInfo PE