Picking up the pieces
In addition to simple fingerprints of files, be they fuzzy or otherwise, a file can give us several other basic pieces of information about it without executing. Attackers have a few simple tricks that are frequently used to attempt to slow down analysis of malware.
Malware serotyping
Take, for instance, our current sample—888888.png; if we open this file as a .png image, it appears to be corrupt!
Adversaries frequently change the extension of files, sometimes excluding it altogether and sometimes creating double extensions, such as notmalware.doc.exe, in order to attempt to obfuscate their intentions, bypass EDR solutions, or utilize social engineering to entice a user into executing their payload.
Fortunately for malware analysts, changing a file's extension does not hide its true contents, and serves only as an aesthetic change in most regards. In computing, all files have a header that indicates to the operating system how to interpret...
