Learning Malware Analysis

1.2 Identifying File Type Using Tools

The other convenient method of determining the file type is to use file identification tools. On Linux systems, this can be achieved using the file utility. In the following example, the file command was run on two different files. From the output, it can be seen that even though the first file does not have any extension, it is detected as a 32-bit executable file (PE32) and the second file is a 64-bit (PE32+) executable:

$ file minimini: PE32 executable (GUI) Intel 80386, for MS Windows$ file notepad.exenotepad.exe: PE32+ executable (GUI) x86-64, for MS Windows

On Windows, CFF Explorer, part of Explorer Suite (http://www.ntcore.com/exsuite.php), can be used to determine the file type; it is not just ...