Static Analysis: Hashing, Packing & Imports

File Hashing: The Fingerprint of Every Binary

In Lesson 11.1, you extracted strings and examined PE structure. But before you share findings with your team, threat intel feeds, or incident reports, you need one thing: a unique identifier for the file. That identifier is a cryptographic hash.

A hash function takes a file of any size and produces a fixed-length string — a digital fingerprint. Change a single byte in the file, and the hash changes completely. This property makes hashes the universal language of malware identification.

Generating Hashes

Linux:

md5sum suspicious.exe
sha1sum suspicious.exe
sha256sum suspicious.exe

sha256sum suspicious.exe | awk '{print $1}'

Windows (PowerShell):

Get-FileHash suspicious.exe -Algorithm MD5
Get-FileHash suspicious.exe -Algorithm SHA1
Get-FileHash suspicious.exe -Algorithm SHA256

Python (for automation):

import hashlib

with open("suspicious.exe", "rb") as f:
    data = f.read()
    print(f"MD5:    {hashlib.md5(data).hexdigest()}")
    print(f"SHA1:   {hashlib.sha1(data).hexdigest()}")
    print(f"SHA256: {hashlib.sha256(data).hexdigest()}")

Fuzzy Hashing with ssdeep

Cryptographic hashes have a limitation: change one byte and the hash changes completely. Malware authors exploit this by recompiling with minor modifications — a different C2 server, a changed variable name — producing a sample with identical behavior but a completely different SHA256 hash.

ssdeep solves this with context-triggered piecewise hashing (fuzzy hashing). Instead of hashing the entire file, ssdeep divides it into variable-length chunks and hashes each chunk independently. The result is a hash that can be compared for similarity, not just equality.

ssdeep suspicious.exe
# 768:Gj4TtmMbhQovVWq+x3RTHdha9cAqhbB7GoNai:Gj4TtHbhQovVN+xBTya9FqhZ7Gi

ssdeep -r /malware/samples/ > hashes.txt

ssdeep -d hashes.txt

Hash Lookups: Has Anyone Seen This Before?

Once you have the hash, the first question is: has the security community already analyzed this file?

VirusTotal

VirusTotal aggregates results from 70+ antivirus engines and provides behavioral analysis, community comments, and network indicators.

# Search by SHA256 hash (API)
curl -s "https://www.virustotal.com/api/v3/files/SHA256_HASH_HERE" \
  -H "x-apikey: YOUR_API_KEY" | python3 -m json.tool

# Web interface: https://www.virustotal.com/gui/file/SHA256_HASH_HERE

What to look for on VirusTotal:

MalwareBazaar

MalwareBazaar (by abuse.ch) is a malware sample sharing platform focused on tracking active threats:

curl -s -X POST "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_info&hash=SHA256_HASH_HERE"

MISP Integration

In Module 5, you learned to use MISP for threat intelligence. Every hash you extract during malware analysis should be checked against your MISP instance — and new hashes should be added as IOCs to share with your community.

Packer Detection: When the Binary Hides Its True Self

Packing is a technique where malware is compressed, encrypted, or otherwise transformed so that static analysis reveals nothing useful. The packed binary contains a small unpacking stub that reconstructs the original code in memory at runtime.

Click to enlarge

Why Attackers Pack Binaries

• Evade signatures: Antivirus rules written for the original strings and byte patterns will not match the packed version
• Defeat static analysis: Strings, imports, and PE structure of the packed binary reveal the packer, not the malware
• Reduce file size: Some packers (like UPX) compress binaries to 30-50% of original size
• Slow down analysts: Unpacking adds time and complexity to the investigation

Identifying Packed Binaries

Common Packers

Entropy Analysis

Shannon entropy measures randomness on a scale from 0 (perfectly ordered) to 8 (perfectly random). Encrypted or compressed data has high entropy. Normal compiled code has moderate entropy.

python3 -c "
import math, sys
with open(sys.argv[1], 'rb') as f:
    data = f.read()
freq = [0]*256
for b in data: freq[b] += 1
entropy = -sum((c/len(data)) * math.log2(c/len(data)) for c in freq if c > 0)
print(f'Entropy: {entropy:.4f}')
" suspicious.exe

Basic UPX Unpacking

UPX is the most common packer encountered in malware analysis. Unpacking is trivial when UPX headers are intact:

upx -t suspicious.exe
# suspicious.exe: UPX executable packer [OK]

upx -d suspicious.exe -o unpacked.exe

strings unpacked.exe | wc -l
# Now you see the real strings

Some malware authors modify UPX headers to prevent the standard upx -d command from working. In those cases, you need to fix the headers manually or use dynamic unpacking (dump the process memory after the unpacking stub runs).

Import Address Table (IAT) Analysis

The Import Address Table lists every external function the binary calls from Windows DLLs. This is one of the most powerful static analysis artifacts because the APIs a binary imports directly reveal its capabilities.

Click to enlarge

Reading the Import Table

Linux (on a PE file):

objdump -x suspicious.exe | grep -A 100 "Import Address Table"

python3 -c "
import pefile
pe = pefile.PE('suspicious.exe')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    print(f'\n{entry.dll.decode()}:')
    for imp in entry.imports:
        print(f'  {imp.name.decode() if imp.name else hex(imp.ordinal)}')
"

Windows (PowerShell with dumpbin):

dumpbin /imports suspicious.exe

Suspicious API Call Categories

Process Injection:

Execution and Download:

Persistence:

Defense Evasion:

DLL Analysis

Malware does not always arrive as a standalone .exe. Many advanced threats use DLL side-loading or DLL injection — placing a malicious DLL where a legitimate application will load it.

When analyzing a DLL:

python3 -c "
import pefile
pe = pefile.PE('suspicious.dll')
print(f'Exports ({len(pe.DIRECTORY_ENTRY_EXPORT.symbols)}):')
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
    print(f'  {exp.ordinal}: {exp.name.decode() if exp.name else "(ordinal only)"}')
"

Key Takeaways

• Cryptographic hashing (MD5, SHA1, SHA256) provides unique file identification — always compute all three for cross-platform lookups
• Fuzzy hashing (ssdeep) identifies malware variants that share code despite different cryptographic hashes
• Hash lookups on VirusTotal, MalwareBazaar, and MISP reveal whether the security community has already analyzed your sample — search by hash before uploading files
• Packing compresses or encrypts binaries to defeat static analysis — detect it through high entropy, few imports, unusual sections, and small .text
• UPX is the most common packer and trivially unpacked with upx -d; commercial protectors like Themida and VMProtect require advanced techniques
• Entropy analysis (Shannon entropy) quantifies randomness — sections above 7.0 are almost certainly encrypted or compressed
• Import Address Table analysis reveals a binary's capabilities: process injection APIs, network functions, persistence mechanisms, and evasion techniques
• A binary importing only LoadLibraryA and GetProcAddress is hiding its real imports through dynamic resolution — a key packing indicator
• DLL analysis extends the same techniques to side-loading and injection scenarios common in advanced threats

What's Next

Static analysis has told you what the file contains, how it is built, and what APIs it calls. But there are questions static analysis cannot answer: What does the malware actually do when it runs? What files does it create? What processes does it spawn? What network connections does it make? In Lesson 11.3, you will cross into dynamic analysis — executing malware in a controlled sandbox and monitoring its behavior with Process Monitor, Process Explorer, and Autoruns to build a complete behavioral profile.