## Static Analysis Tools: The Surgeon's Kit

Here are the essential tools you will use during Static Analysis. Most are free.

### 1. VirusTotal (The First Stop)
*   **What it is**: A website that scans your file with 70+ Antivirus engines.
*   **Usage**: Upload hash.
*   **Verdict**:
    *   50/70 red: Definitely Malware.
    *   0/70 green: Clean... OR a brand new Zero-Day.
    *   **Community Tab**: Read comments. Other analysts often post "This is Emotet dropped via phishing."

### 2. Strings
*   **Command**: `strings file.exe` (Linux) or `strings.exe` (Windows Sysinternals).
*   **Function**: Extracts printable characters.
*   **What to hunt**:
    *   IP Addresses (`1.2.3.4`).
    *   URLs (`http://...`).
    *   Filenames (`dropped_malware.exe`).
    *   Registry Keys (`SoftwareMicrosoftWindowsCurrentVersionRun`).
    *   Error messages (often reveal the compiler/language).

### 3. PEStudio (Windows)
*   **Function**: Deep inspection of the Portable Executable (PE) header.
*   **Key Features**:
    *   **Indicators**: Highlights suspicious things in red (e.g., "File has no digital signature", "File references a browser").
    *   **Imports**: Shows what DLLs/APIs are used.
    *   **Resources**: Sometimes malware hides a second .exe inside its "Icon" or "Image" resource section.

### 4. Capa (Mandiant)
*   **Function**: "What does this do?" using rules.
*   **Output**: Instead of showing you assembly code, it says:
    *   "Capability: Encrypts Data using AES"
    *   "Capability: Connects to HTTP"
    *   "Capability: Takes Screenshot"
*   It's like Google Translate for Assembly code.

### 5. PEiD / Detect It Easy (DiE)
*   **Function**: Detects **Packers**.
*   **Scenario**: You run `strings` and see random garbage.
*   **DiE says**: "Packed with UPX".
*   **Action**: You know you must unpack it (using `upx -d` or manual unpacking) before you can analyze it.