Learning Malware Analysis

4.1 String Extraction Using Tools

To extract strings from a suspect binary, you can use the strings utility on Linux systems. The strings command, by default, extracts the ASCII strings that are at least four characters long. With the -a option it is possible to extract strings from the entire file. The following ASCII strings extracted from the malicious binary show reference to an IP address. This indicates that when this malware is executed, it probably establishes a connection with that IP address:

$ strings -a log.exe!This program cannot be run in DOS mode.Rich.text`.rdata@.dataL$"%h4z@128.91.34.188%04d-%02d-%02d %02d:%02d:%02d %s

In the following example, the ASCII strings extracted from a malware called Spybot give an indication of ...