PE Malware Analysis Lab

This repository is a structured learning project focused on Windows Portable Executable analysis and malware analysis methodology.

It continues from the foundation work completed in ReverseLogic-Lab:

https://github.com/Bor-Code/ReverseLogic-Lab

The samples in this repository are controlled and benign. The goal is to learn analysis methodology, not to create malware.

Purpose

The purpose of this project is to understand:

• how Windows PE files are structured
• how imports, exports, strings, sections, and entropy are analyzed
• how runtime behavior is monitored
• how debugger evidence is collected
• how malware analysis findings are reported clearly

Repository Structure

docs/
  roadmap.md
  workflow.md

labs/
  01-pe-header-analysis/
  02-import-table-analysis/
  03-export-table-analysis/
  04-strings-and-section-analysis/
  05-entropy-and-packing-indicators/
  06-basic-packer-concept-lab/
  07-api-monitoring-behavior-lab/
  08-x64dbg-runtime-verification/
  09-malware-report-template-methodology/
  10-worked-example-analysis-report/

reports/
  report-template.md
  01-api-monitoring-worked-example.md

Completed Labs

01 - PE Header Analysis

Covers DOS Header, NT Headers, Optional Header, Section Table, and basic PE structure.

02 - Import Table Analysis

Covers imported DLLs, imported API functions, Import Table, and Import Address Table basics.

03 - Export Table Analysis

Covers DLL exports, Export Table, Export Address Table, exported function names, and DllMain.

04 - Strings and Section Analysis

Covers visible strings, read-only data, writable data, stack strings, and PE section layout.

05 - Entropy and Packing Indicators

Covers Shannon entropy, encoded-looking data, strings comparison, and packing indicators.

06 - Basic Packer Concept Lab

Covers XOR-encoded data, runtime decoding, hidden plaintext, and basic packer concepts.

07 - API Monitoring Behavior Lab

Covers file system activity, registry activity, Process Monitor usage, and runtime behavior evidence.

08 - x64dbg Runtime Verification

Covers DebugBreak, debugger stop points, runtime observation, and loaded module inspection.

09 - Malware Report Template Methodology

Covers report structure, static analysis reporting, dynamic analysis reporting, findings, indicators, and limitations.

10 - Worked Example Analysis Report

Applies the report template to a controlled sample and documents static and dynamic findings.

Methodology

The project follows this learning path:

PE headers
-> imports and exports
-> strings and sections
-> entropy and packing indicators
-> runtime decoding
-> API monitoring
-> debugger verification
-> report methodology
-> worked example report

Tools

Tools used across the labs:

• MSYS2 MINGW64 GCC
• Ghidra
• x64dbg
• Process Monitor
• objdump
• strings
• Python
• Git
• GitHub

Build Notes

Generated binaries are used only locally for analysis and are not committed.

Ignored generated files include:

*.exe
*.dll
*.obj
*.o
*.pdb
*.ilk
*.exp
*.lib

Git Workflow

All work follows this workflow:

main
feature branch
pull request
review
squash and merge
main

Rules:

• Do not push directly to main.
• Use feature branches.
• Use Conventional Commits.
• Do not use emoji.
• Use squash merge.
• Add @theilgaz as reviewer when available.
• Do not commit generated executables.

Commit Convention

Examples:

feat: add PE header analysis lab
docs: update report methodology
fix: correct import explanation
chore: update repository structure

Current Status

This repository contains ten focused labs covering PE analysis, runtime behavior monitoring, debugger verification, and malware analysis reporting methodology.

The next step is to apply this methodology to more complex controlled samples and gradually move toward realistic malware analysis workflows in isolated environments.