See the Analy­sis data / foren­sic arti­cle for gen­er­al data analy­sis. Also, rel­e­vant articles:

• Reverse Engi­neer­ing tools for the Lin­ux ELF — akde/infosec
• The Lin­ux Exe­cutable and Link­ing For­mat (ELF) — akde/infosec

Static analysis

Notes before­hand:

• Cal­cu­late some hash­es from the file and throw it into a search engine, Virus­To­tal and see what hap­pens. Try also ssdeep fuzzing hash­es.
• See on MalAPI.io for pos­si­ble neg­a­tive Win32 func­tions which could appear in binaries.

Have a first look into the file:

xxd file.exe | less

Have a look into the file segments

binwalk file.exe

• If bin­walk sees mul­ti­ple inter­est­ing seg­ments, try to extract all seg­ments:
  binwalk --dd '.*' file.exe

Have a look in the strings

strings file.exe
floss file.exe

You can try to visu­al­ize the entropy to maybe detect seg­ments of encrypt­ed data (high entropy) or poten­tialy human read­able seg­ments (low entropy).

Have a look into the func­tions and a de-assem­bled code view:

rabin2 -zzz file.exe

Analyse the seg­ments of a PE file

pescan file.exe

List more func­tions of a PE file and list used functions:

readpe file.exe

Extract all PE file ressources:

peres --all file.exe

Use radare2 or oth­er dis­as­sem­bler to analyse further.

Dynamic analysis

Procmon

Use Proc­mon (Sys­in­ter­nals Tools) to see which libraries and (net­work) sock­ets a exe­cute­ables uses. Note: Set the fil­ter accord­ing­ly before!

API Monitor

API Mon­i­tor can also be used to ana­lyze a PE file. Open/Attach to a process and ana­lyze it.

Immunity

Process Hacker 2

Process Hack­er 2 is a task man­ag­er with more infor­ma­tion also about loaded libraries and more.

Speakeasy

Speakeasy is a win­dows ker­nel emu­la­tor. Mal­ware can be excut­ed with­in (this should not be the only line of defense, of course).

Analysis frameworks

Cuckoo Sandbox

Out­dat­ed 🙁

VMRay

Com­mer­cial

SysAnalyzer

Sys­An­a­lyz­er is a analy­sis framework.

Noriben

Noriben is a Proc­mon-baesd mal­ware analy­sis sandbox.

Other tools

• Explor­er Suite – NTCore