PE Autopsy: Triage a Real Signed Windows Binary
PE Autopsy: Triage a Real Signed Windows Binary
Static analysis of a real 64-bit Windows executable: headers, entry point, mitigations, entropy, imports, hidden strings and the signature.
Briefing
Triage is the first hour with any sample: identify it, read its headers, check for packing, list what it can do, and decide what deserves deeper work.
Your sample is a real, widely used program: the 64-bit PuTTY 0.83 executable, downloaded from its official site. It is benign, which makes it the perfect baseline: every "suspicious" signal you find has an innocent explanation you must be able to give.
Download it, verify it, and answer every question from the file itself.
Topics you practise
Evidence
putty.exe (PuTTY 0.83, 64-bit)
Official build. Check the SHA-256 below before you start: a sample you have not verified is not the sample you think it is. (1.6 MB)
Source: PuTTY official site (Simon Tatham). MIT licence.
16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28adSuggested tools: PE-bear or CFF Explorer, pefile (Python), Detect It Easy, sha256sum or Get-FileHash, strings or FLOSS.
At what file offset does the PE signature ("PE\0\0") start? This is the value of e_lfanew.
Format: hex, like 0x40.
What is the Machine field of the COFF header?
Format: hex, like 0x14c.
What is the AddressOfEntryPoint RVA?
Format: hex, like 0x1a2b.
If the image loads at its preferred ImageBase, what is the virtual address of the entry point?
Format: hex, like 0x401000.
Which section contains the entry point?
Format: the section name, like .data.
DllCharacteristics is 0x8160. Which of these mitigations is NOT enabled: ASLR, high-entropy ASLR, DEP, or Control Flow Guard?
Format: one of the four names.
What is the entropy of the .text section, in bits per byte?
Format: a number to 2 decimal places.
How many functions does the import table list in total, across all DLLs?
Format: a number.
PuTTY is a network client, yet no socket library is in its import table. Which Winsock DLL name appears as a plain string in the file?
Format: the DLL file name.
When was the file built? Convert the COFF TimeDateStamp to a UTC date.
Format: YYYY-MM-DD.
Each task is worth 100 points: minus 15 per wrong answer and 25 for a hint (never below 40). Finish when you are done; 15 unsolved tasks score 0. Your progress is saved on this device.