Performing a quick malware analysis with strings and VirusTotal
Malware analysis is one of those advanced topics that I can’t cover in detail here. However, I can show you a couple of quick ways to analyze a suspicious file.
Analyze a file with strings
Executable files often have strings of text embedded in them. You can use the strings utility to look at those strings. (Yeah, that makes sense, right?) Depending on your distro, strings might or might not already be installed. It’s already on CentOS and AlmaLinux, but to get it on Ubuntu, you’ll need to install the binutils package, like so:
sudo apt install binutils
As an example, let’s look at a Your File Is Ready To Download_2285169994.exe file that was automatically downloaded from a cryptocoin faucet site. To examine the file, I’ll do this:
strings "Your File Is Ready To Download_2285169994.exe" > output.txt
vim output.txt
I saved the output to a text file...
