Lion Cipher Lab

Triage a Windows executable with PEStudio: indicators, imports, and what they reveal

• Digital Forensics & IR (DFIR)
• Intermediate
• ~40 min
• Free · no account required

Why it matters

When a suspicious .exe lands in a quarantine folder, the fastest, safest first move is to open it in a static triage tool and read what it confesses about itself — never to double-click it. PEStudio is the tool most SOC and DFIR analysts reach for to do exactly that: it parses a Windows executable without running it and lays out, on one screen, the indicators it thinks are suspicious (ranked by severity), the imported functions it flags as blacklisted, the strings, the sections with their entropy, the header, the hashes, and a VirusTotal score. From that view alone a trained analyst can often…

What you'll learn

• reading PEStudio's indicators panel and interpreting its severity ranking
• reading the imports view and understanding why PEStudio flags some functions as blacklisted
• mapping blacklisted Win32 APIs to capabilities (network, injection, persistence, crypto, anti-analysis)
• recognising the process-injection API cluster (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread)
• reading a sections table and using per-section entropy to spot a packed binary
• reading the header for a missing rich signature and a faked compile timestamp
• using the file's hashes and VirusTotal score as triage context, not as a verdict
• building a capability hypothesis from static artifacts alone, without executing the file
• judgment: when PEStudio static triage is enough and when packing/obfuscation blinds it

Steps in this lab

1. What PEStudio is — and the one screen it gives you
2. WHEN PEStudio static triage is the right first move — and the safety envelope
3. The file panel — name, hashes, signature, and the VirusTotal score
4. The header — compiler, a missing rich signature, and a faked timestamp
5. The indicators panel — read the severity, not just the list
6. The sections table and entropy — the packing tell
7. Blacklisted imports — network, persistence, crypto, anti-analysis
8. The cluster that screams loudest: process injection
9. The strings panel — corroborate the imports
10. Build the capability hypothesis — from the static view alone
11. The third rule: when PEStudio is enough, and how a pro closes the gap

Open the full interactive lab →