Search code examples
securityportable-executablemalware

How to identify malware extensions from hash?


The malware I'm trying to analyze is saved without a file extension and just the hash. I would like to know basic info about this file, such as whether it is .dll vs .exe and whether it is 64bit or 32bit. What is the best way to do this?


Solution

  • I would suggest to use pestudio www.winitor.com as Malware Initial Assessment tool. This tool shows many details of any Portable Executable file (aka. PE). Additionally, it queries Virustotal (submitting the hash of the file and NOT the file itself) to check whether the file is already known.