InspectExe Tutorial: Step-by-Step Static and Dynamic AnalysisInspectExe is a powerful tool for examining Windows executable files (PE files). This tutorial walks you through a practical, step-by-step workflow for both static and dynamic analysis, suitable for malware analysts, reverse engineers, and curious developers. It assumes basic familiarity with Windows internals and general reverse-engineering concepts.
Table of contents
- Overview and goals
- Preparing your environment
- Static analysis
- File identification and metadata
- PE headers and section analysis
- Strings, imports, and exports
- Embedded resources and certificates
- Signature and entropy checks
- Dynamic analysis
- Safe sandbox setup
- Process execution and monitoring
- API call tracing and behavior analysis
- Network activity and file system changes
- Memory inspection and unpacking
- Combining static and dynamic findings
- Reporting and remediation guidance
- Example full walkthrough (sample malware-like binary)
- Best practices and tips
1. Overview and goals
This tutorial will show how to use InspectExe to extract actionable intelligence from a Windows executable using both static techniques (no execution) and dynamic techniques (controlled execution). Goals:
- Determine whether a binary is malicious or suspicious.
- Understand core functionality and indicators of compromise (IOCs).
- Extract useful artifacts for defensive measures (hashes, domains, YARA rules).
2. Preparing your environment
- Use an isolated analysis environment: a virtual machine (VM) with snapshots. Preferably disconnected from production networks.
- Install InspectExe and supporting tools: a hex editor, PE viewers, debugger (x64dbg or WinDbg), and network capture (Wireshark). Optionally, set up a controlled C2 simulation or sinkhole for outgoing connections.
- Ensure the VM has host-only or NAT networking, and use routing/blocks to prevent harm.
- Take a clean snapshot before starting.
3. Static analysis
Static analysis inspects the file without running it. It’s safe and often yields immediate indicators.
3.1 File identification and metadata
- Calculate file hashes (MD5, SHA-1, SHA-256) for tracking and searching threat intelligence.
- Confirm file type and architecture (x86 vs x64).
- Check file size and timestamps for anomalies.
Key InspectExe actions:
- Load the binary and record SHA-256 and architecture immediately.
3.2 PE headers and section analysis
- Inspect the DOS header, NT headers, optional header and section table.
- Note the entry point (AddressOfEntryPoint), image base, and subsystem.
- Examine section names, sizes, and characteristics (executable, writable). Unusual or custom section names (e.g., .upx1, .packed) often indicate packing.
Look for:
- Sections with high entropy (possible packing/encryption).
- Executable writable sections (suspicious).
- Mismatched sizes or missing overlay information.
3.3 Strings, imports, and exports
- Extract readable strings; search for URLs, IPs, mutex names, C2 domains, registry keys, and suspicious commands.
- Inspect the import table to see which Windows APIs the binary uses (networking APIs like WinINet, WinSock, CreateRemoteThread, VirtualAlloc, WriteProcessMemory are notable).
- Examine exports for dropped libraries or plugins.
Use InspectExe to:
- Export strings and filter by keywords (http, cmd, CreateProcess).
- Generate an import summary showing potentially dangerous functions.
3.4 Embedded resources and certificates
- Check embedded resources (icons, dialogs, version info) for clues about authorship or repacking.
- Validate Authenticode signatures; absence is normal for many malware samples, but a forged or expired signature is suspicious.
3.5 Signature and entropy checks
- Compute entropy per section. Values close to 8.0 often indicate compressed/encrypted data.
- Use YARA rules to match known malware families.
InspectExe can:
- Display entropy graphs and run built-in signature checks.
4. Dynamic analysis
Dynamic analysis executes the binary in a controlled manner to observe runtime behavior. Always use a sandboxed VM.
4.1 Safe sandbox setup
- Revert to a clean snapshot.
- Start network capture and host monitoring tools.
- Disable guest-to-host clipboard and shared folders unless intentionally testing them.
4.2 Process execution and monitoring
- Run the sample and observe process creation. Record parent process and command-line arguments.
- Use InspectExe’s process monitor or integrate with Procmon/x64dbg to collect detailed events.
Watch for:
- Process hollowing, new child processes, and service registrations.
- Suspicious command lines or use of rundll32, regsvr32, mshta, or certutil.
4.3 API call tracing and behavior analysis
- Trace API calls to observe network operations, file I/O, registry modifications, and code injection attempts.
- Look for calls to VirtualAlloc/VirtualProtect followed by WriteProcessMemory/CreateRemoteThread (indicative of injection/unpacking).
InspectExe dynamic features:
- Live API hooking and call logging to see parameters and return values.
- Timeline view of significant events.
4.4 Network activity and file system changes
- Capture DNS queries, HTTP requests, and raw socket traffic. Extract any C2 domains or IPs.
- Monitor file writes, dropped files, and registry keys created/modified.
Common indicators:
- Beacons to domains at regular intervals.
- Use of uncommon ports or obfuscated URLs.
4.5 Memory inspection and unpacking
- If the binary is packed, use memory dumps post-unpacking (after VirtualAlloc/Write sequence) to extract the unpacked code.
- Search memory for PE headers (MZ, PE ) and dump them for offline static analysis.
InspectExe helps by:
- Allowing memory snapshots and automated scanning for in-memory PEs.
5. Combining static and dynamic findings
Correlate:
- Strings found statically with actual network requests observed dynamically.
- Imported API usage with runtime call traces (confirms capabilities).
- High-entropy sections with memory-dumped unpacked code.
This combined approach increases confidence in verdicts and reduces false positives.
6. Reporting and remediation guidance
A concise analyst report should include:
- Sample hashes (SHA-256), file name, size, and architecture.
- Summary of static findings (notable imports, high-entropy sections, suspicious strings).
- Summary of dynamic findings (process behavior, network indicators, files/registry changes).
- IOCs: domains, IPs, mutexes, file paths.
- Suggested mitigations: block domains/IPs, update detection signatures, isolate affected hosts, and wipe/reimage if persistence observed.
7. Example full walkthrough (concise)
- Load sample into InspectExe — record SHA-256 and architecture.
- Static: find high-entropy .rdata, imports include WinSock and VirtualAlloc, strings show suspicious domain example[.]com.
- Dynamic: execute in VM, observe process spawns, API trace shows VirtualAlloc + WriteProcessMemory then CreateRemoteThread.
- Network: DNS requests to example[.]com every 60s; HTTP POST with encoded payload.
- Memory: dump in-memory PE after unpacking; analyze with IDA/Ghidra to extract command handler logic.
- Report: include IOCs, recommended blocks, and cleanup steps.
8. Best practices and tips
- Always start with static triage to determine risk before dynamic execution.
- Use snapshots and revert frequently.
- Combine multiple tools (InspectExe, Procmon, Wireshark, x64dbg) for fuller visibility.
- Automate repetitive tasks: hash calculation, YARA scanning, and IOC extraction.
- Maintain a personal lab checklist and a curated YARA/IOCs repo.
This tutorial outlines a practical static + dynamic workflow using InspectExe to evaluate Windows executables. Adjust each step to your environment and threat model; prioritize safety and repeatability.
Leave a Reply