Using ASCII and UTF-16 Strings to Analyze PE Files
· 12:04 · Watch on YouTube ↗
Summary
A hands-on lesson uses a toy downloader to explain ASCII and UTF-16 strings, imports, and basic PE analysis, with FLOSS for string recovery and FakeNet to simulate download-and-execute behavior.
Key points
- Wide-character builds use UTF-16 strings; A/W API suffixes indicate the string format expected by a function.
- The demonstration compiles an x86 PE downloader and uses FakeNet to simulate DNS resolution and payload delivery and execution.
- FakeNet logs show the demo requesting example[.]com/update.exe, illustrating how network logs can help identify downloader behavior.
- FLOSS recovers stack, tight, and decoded strings and attempts deobfuscation; its output can include compiler- and library-generated artifacts.
- Analysts should distinguish useful ASCII or UTF-16 strings from incidental binary noise and examine imports to identify APIs and libraries.
Article Details
- Topics
- [00:00] Wide-character strings and A/W API suffixes
- [02:42] Compiling a PE downloader and simulating its behavior with FakeNet
- [04:03] Using network logs to distinguish a downloader from a dropper
- [05:03] Recovering strings with FLOSS
- [07:10] Interpreting UTF-16 strings and compiler-generated artifacts
- [09:12] Examining ASCII strings, imports, and binary noise