Search code examples
securityexecutableportable-executablemalwarefile-type

PE/ELF executable file format- Malware sample Execution


I have downloaded some malware samples both in Linux and Windows VM. when I check file type of the samples in Linux using file * command, the type is displayed as PE32 executable. However, when I check the same in windows VM , the file type is mentioned as "file".

Does that mean those samples are not executable?

Do I have to change the extension to .exe to make it as an executable?


Solution

  • I would recommend reading up on the PE format, as not only .exe file extensions are PE32 executables(e.g. .dll).

    If I were you I would also start with learning about how to construct safe Lab environments, and how to use some static analysis tools before running anything (make sure your VM networking is set up safely).

    To your question: The linux file command should be accurate in identifying the files you are looking at, not sure what exact check you did in Win.

    Yes, changing the file extension helps, but also doesn't guarantee the malware will run as you would expect. DLLs for instance need to be loaded with rundll32, there can be sandbox/VM checks, packing that won't execute etc.

    You can check which file you are dealing with in a hex editor and comparing the magic bytes.