PeStudio also provides the first bytes in hexadecimal, in the image above we can see this is ‘4D 5A’. Here we are presented with information such as hashes of the sample, if you are dealing with a malware-related incident in your organization you could use this information to start blocking and looking for devices that have these hashes on the filesystem. Upon opening a malware sample in PeStudio the user is presented with the ‘Main’ tab. The user is then presented with a number of tabs that provide varying information that PeStudio has pulled out of the sample Main Tab Double-clicking the desktop icon opens the tool, to start investigating a piece of malware simply drag the malware sample into the tool. What I love about PeStudio is how easy it is to use and the clear, simple layout of the tool. In this article, I will cover what PeStudio is, some of the key features and how you can use it to begin analyzing malware. This is great for the initial triage of a malware sample. It provides so much information about the sample and gives me a wealth of information for me to start building out my report. Whenever I begin analysing a piece of malware, I will always load it into PeStudio first. PeStudio is a tool used for statically analyzing malware and is one of my favourite tools for malware analysis.

Pestudio on an img file