PEStudio Cheatsheet
What It Is
Static PE analysis tool that performs initial triage without executing the file. Highlights anomalies and suspicious indicators.
Quick Start
- Launch PEStudio
- Drag and drop the suspect file (or File > Open)
- Review the left panel sections top-to-bottom
Key Sections
| Section | What to Check |
|---|---|
| indicators | Red/yellow flags for anomalies |
| virustotal | Quick VT detection check (if enabled) |
| strings | Embedded text (URLs, paths, commands) |
| imports | API functions used — reveals capabilities |
| sections | Section names, entropy, sizes |
| resources | Embedded files, icons, version info |
| tls | TLS callbacks (pre-main execution) |
| manifest | Requested privileges (admin?) |
Red Flags to Watch For
- High entropy sections (>7.0) → packed/encrypted
- Non-standard section names (.UPX, .themida, etc.) → packed
- Suspicious imports (VirtualAllocEx, WriteProcessMemory)
- Blacklisted strings (cmd.exe, powershell, http://)
- No manifest or requestedExecutionLevel = requireAdministrator
- TLS callbacks present → code runs before entry point
- Raw size vs virtual size mismatch → possible packing
Import Analysis
Focus on these import groups:
- kernel32.dll: CreateFile, CreateProcess, VirtualAlloc
- advapi32.dll: RegSetValueEx, CreateService (persistence)
- ws2_32.dll / wininet.dll: Network operations
- crypt32.dll: CryptDecrypt, CryptUnprotectData
Section Analysis
| Section | Normal Entropy | Packed Entropy |
|---|---|---|
| .text | 5.5-6.5 | >7.0 |
| .data | 1.0-5.0 | >7.0 |
| .rsrc | 3.0-5.0 | >7.0 |
| .rdata | 4.0-6.0 | >7.0 |
Pro Tips
- Use PEStudio before any other tool (30-second triage)
- Export the indicators list as your initial IOC set
- Check the compilation timestamp (unreliable but informative)
- Compare imphash against known malware families