Analyzing Wide-Character Strings and Imports in Malware Binaries

Summary

The lesson demonstrates using Floss and dump bin to inspect wide-character strings and import tables, and explains how compiler/runtime behavior and sparse imports can complicate malware triage.

Key points

• Floss can extract both ASCII and UTF-16LE strings from a binary; meaningful strings may appear in either format.
• Strings such as file paths, URLs, IP addresses, and mutexes can help analysts build an initial picture of a sample’s behavior.
• Import tables show libraries and APIs linked into a program, including network-related functions such as URLDownloadToFile.
• Compiler and runtime code can add imports that do not reflect the program author’s intent, so an imported API alone is not proof of a capability such as anti-debugging.
• A sparse or absent import table may indicate that imports are resolved or constructed at runtime, which the lesson describes as common in malware.

Tools

Related Articles

• Signed Fake PeaZip MSI Installs a DLL-Sideloading, Self-Updating Loaderrogueauthority.orgFLOSS
• Signed PuTTY Installer Hides a Node.js Malware Loaderrogueauthority.orgFLOSS
• New Spyder Downloader Uses Sandbox Evasion and Targets South Asian Policerogueauthority.orgFLOSS
• Fake Windows Update Steals Passwords and Logs Every Attemptrogueauthority.orgFLOSS
• DarkMe RAT Campaign Uses Phishing and PIF Files Instead of Exploitshuntress.comFLOSS