## Key Indicators: Strings & Hashes

This is "Basic Static Analysis". It takes 5 minutes and solves 50% of cases.

### 1. File Hashing
A hash is a one-way mathematical fingerprint changes. If you change 1 bit of the file, the hash changes completely.
*   **MD5**: 32 chars. Fast. Broken (Collisions possible). OK for database lookups.
*   **SHA-256**: 64 chars. Standard. Unique.
*   **Workflow**:
    1.  Get Sample.
    2.  `sha256sum malware.exe`.
    3.  Paste hash into **VirusTotal.com**.
    4.  If 50/70 vendors say "Malicious", you are done.

### 2. Strings Analysis
Programmers leave text in code: URLs, IP addresses, Error Messages, Passwords.
The `strings` command extracts all ASCII and Unicode readable text.
*   **Suspicious Strings**:
    *   `CreateRemoteThread` (Used for Injection).
    *   `URLDownloadToFile` (Dropper behavior).
    *   `192.168.x.x` (Internal IPs).
    *   `cmd.exe /c` (Command execution).
    *   `C:UsersTarget...` (PDB Paths showing the author's username!).

### 3. Packing & Entropy
Malware authors "Pack" their code (like a ZIP file) to hide these strings from antivirus.
*   **Entropy**: Randomness.
*   **Low Entropy**: Standard English text (lots of repeated patterns like "the").
*   **High Entropy**: Encrypted or Compressed data (looks like random noise).
*   **Detection**: If a file has Entropy > 7.0 (out of 8), it is likely Packed. You won't see any strings until you unpack it.