Why Strings Matter
Before running a single tool beyond a text extractor, strings embedded in a binary can reveal: the C2 server address, the ransom note text, the registry persistence key, the mutex name, the dropped file path, the user-agent string, the debug build path, and the developer's error messages.
Strings are the analyst's first intelligence layer. They cost almost nothing to extract and frequently provide enough to identify the malware family and write detection rules before any dynamic analysis.
The Basic strings Tool
The strings command (available on Linux and in FlareVM) extracts printable ASCII sequences of four or more characters from a binary.
strings -n 6 suspicious.exe # minimum length 6 chars
strings -e l suspicious.exe # Unicode (UTF-16LE) strings
strings -n 6 suspicious.exe | grep -iE "(http|ftp|cmd|powershell|reg|pass)"
Limitation: strings only finds plaintext sequences already present in the binary. Stack-constructed strings, XOR-encoded strings, and strings assembled at runtime are invisible to it.
FLOSS: FLARE Obfuscated String Solver
FLOSS (Mandiant) goes beyond strings by emulating short function sequences in the binary and capturing decoded string values at runtime: without executing the full binary.
floss suspicious.exe # run full analysis
floss --no-static suspicious.exe # skip plain strings, show decoded only
floss -o results.txt suspicious.exe # save output
FLOSS recovers three categories that strings misses:
| Category | Description | Example |
|---|---|---|
| Stack strings | Characters pushed onto the stack one at a time and assembled | http://c2.evil.com/gate.php built byte by byte |
| Tight loop XOR | Single-byte or multi-byte XOR decoding loop | C2 URL XORed with key 0x55 |
| Obfuscated sequences | Any short function that produces a string | Base64 decode, character substitution |
What to Search For in String Output
After running FLOSS, search the output systematically:
Network indicators
grep -iE "(https?://|ftp://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" floss_output.txt
Look for: C2 URLs, hardcoded IP addresses, domain names, port numbers.
File system indicators
grep -iE "(%temp%|%appdata%|system32|\.exe|\.dll|\.bat|\.ps1)" floss_output.txt
Look for: dropped file paths, persistence locations, payload names.
Registry indicators
grep -iE "(HKEY|CurrentVersion\\\\Run|Software\\\\Microsoft)" floss_output.txt
Look for: persistence keys, configuration storage locations.
Anti-analysis indicators
grep -iE "(vmware|virtualbox|sandbox|wireshark|procmon|ollydbg)" floss_output.txt
Look for: VM detection strings, analysis tool names the malware checks for.
Debug and attribution strings
grep -iE "(\\.pdb|\\\\src\\\\|\\\\project\\\\|error|exception|failed)" floss_output.txt
Look for: PDB file paths (reveal developer directory structure), error messages (reveal programming language and coding style).
A Real Example: What Strings Reveal
From a Ryuk ransomware sample, FLOSS recovered:
C:\Windows\System32\cmd.exe
/c vssadmin delete shadows /all /quiet
/c wmic shadowcopy delete
SOFTWARE\Microsoft\Windows NT\CurrentVersion
RyukReadMe.txt
UNIQUE_ID_DO_NOT_REMOVE
From these strings alone, before any dynamic analysis:
- Confirmed ransomware: shadow copy deletion is the giveaway
- Persistence mechanism: registry key path visible
- Ransom note filename:
RyukReadMe.txt - Campaign marker:
UNIQUE_ID_DO_NOT_REMOVE
Each string becomes an IOC. The vssadmin delete shadows command alone is enough to write a Procmon alert and an EDR detection rule.
Mutex Names
Malware creates a named mutex on startup to prevent multiple instances from running simultaneously. The mutex name is typically hardcoded and unique to the malware family.
strings output includes: "Global\\MicrosoftUpdateService3"
A mutex name in the strings output is a high-confidence IOC. Search VirusTotal for the mutex string: if it matches a known family, identification is complete.
PDB Paths
Debug builds of Windows executables contain a path to the Program Database (PDB) file:
C:\Users\developer\Desktop\malware_project\Release\payload.pdb
This is an attribution gold mine: username, directory structure, project name, language (MSVC if .pdb present). Even release builds sometimes retain the PDB path in the binary.
String Analysis Workflow
1. Run: floss suspicious.exe > strings_output.txt
2. Search for network IOCs (URLs, IPs, domains)
3. Search for file system IOCs (paths, dropped filenames)
4. Search for registry IOCs (Run keys, configuration paths)
5. Search for mutex names
6. Search for PDB paths (attribution)
7. Search for anti-analysis strings (VM names, tool names)
8. Record all findings — these become your static IOC list
9. Use this list to confirm or extend findings from dynamic analysis