How to Triage a PE File
Step-by-Step Workflow
1. Compute Hashes
sha256sum sample.exe
md5sum sample.exe
2. VirusTotal Lookup
- Search hash on virustotal.com
- Check detection ratio and family names
- Review behavioral reports if available
3. File Type Identification
file sample.exe
# Check: PE32, PE32+, DLL, .NET assembly?
4. String Extraction
floss sample.exe | tee strings_output.txt
# Look for: URLs, IPs, file paths, registry keys, API names
5. PE Header Analysis
- Check compilation timestamp
- Verify section names and entropy
- Review import table for suspicious APIs
- Check for known packer signatures
6. CAPA Analysis
capa sample.exe
# Review capabilities and ATT&CK mappings
7. Document Findings
Record all IOCs and initial assessment before proceeding to dynamic analysis.
Decision Points
- Packed? → Unpack first (UPX:
upx -d sample.exe) - .NET? → Use dnSpy instead of Ghidra
- Known family? → Read existing reports for context
- No suspicious imports? → May be a loader/dropper (check for dynamic API resolution)