Learning Malware Analysis

1.1 Identifying File Type Using Manual Method

The manual method of determining the file type is to look for the file signature by opening it in a hex editor. A hex editor is a tool that allows an examiner to inspect each byte of the file; most hex editors provide many functionalities that help in the analysis of a file. The following screenshot shows the file signature of MZ in the first two bytes when an executable file is opened with the HxD hex editor  (https://mh-nexus.de/en/hxd/):

You have many options when it comes to choosing hex editors for Windows; these hex editors offer different features. For a list and comparison of various hex ...