[Hands-on] Find the ‘Fingerprint’ of Malware! 🕵️‍♂️ A Complete Guide to Extracting Unique Strings and Signatures

Jul 18, 2026

—

Hello, security analysts! 🛡️

Just as a criminal’s fingerprint is a crucial clue at a crime scene, there are decisive clues in the analysis of ‘malware,’ the criminal of the digital world. These are ‘Unique Strings’ and ‘Signatures.’

Specific hacker groups or malware families tend to leave behind their own habits, unique C&C server addresses, unusual Mutex names, etc., when writing code. Finding these is the first step in analysis and the key to creating detection rules (e.g., YARA).

Today, we will conduct a hands-on session to uncover the identity of malware using only text data hidden within binaries, without complex reverse engineering tools. 🔍

🛑 Caution: Safety First!

NEVER! Run or analyze malware samples on your actual host PC. You must perform the practice in a virtual machine (VM, sandbox) environment isolated from the outside world.

1. What are ‘Strings’? 🤔

Executable files (.exe, .dll, etc.) that we see are blocks of machine code composed of 0s and 1s. However, they also contain information that can be read by humans (or programs).

API Function Names: CreateFile, InternetOpenUrl (provides hints about what actions will be performed)
Network Information: C&C server IP addresses, domain URLs
File Paths and Registry Keys: Self-replication paths, auto-run registration keys for booting
Developer Information: PDB (Program Debug Database) paths, unusual error messages, typos

Our goal is to extract such ‘meaningful information (the core)’ from tens of thousands of lines of meaningless data.

2. Practice Materials 🛠️

We will use the most basic yet powerful tools.

Sample for Analysis: (Safe practice sample or actual sample within a virtual environment)
Strings Tool:

Linux/macOS: Built-in `strings` command
Windows: Sysinternals’ `strings.exe` (highly recommended!) or GUI tools like PEStudio

💡 Tip: In this practice, we will explain based on the command-line `strings` command. This is because it allows us to see the fastest and most raw data.

3. [Hands-on Step 1] Into the Noise: Executing String Extraction 📣

Once you have your malware sample file ready, open a terminal (or CMD) and enter the command below.

Bash

# For Linux/macOS (extracts only strings with at least 8 characters)
strings -n 8 malware_sample.exe > output_strings.txt

# For Windows (Sysinternals) (at least 8 characters, extracts both ASCII and Unicode)
strings.exe -n 8 -a -u malware_sample.exe > output_strings.txt

-n 8 option: Very short strings (e.g., MZ, cmd) are likely noise. Reduce noise by extracting only strings with at least 8 characters.
> output.txt: Saves the output to a file.

Check the results:

Open the generated output_strings.txt file with Notepad. You will see thousands of lines of text. Most of them are garbage values or normal library names. Now, the ‘hidden picture search’ begins. 👀

4. [Hands-on Step 2] Treasure Hunt: Identifying Unique Signatures 💎

In the saved text file, focus on finding the following types of strings. These are powerful signatures that identify specific families.

A. Network Indicators (IOCs) 🌐

This is the most important. You need to find out where the malware is trying to communicate.

Pattern: http://, https://, IP address format (xxx.xxx.xxx.xxx)
Example Found: , 192.168.100.50:8080
👉 Analysis Point: Search threat intelligence services (e.g., VirusTotal) to see if this domain has been used in past malware campaigns.

B. PDB Path (Developer’s Trace) 👣

This is the best information you can find if you’re lucky. It’s the path to the debugging information file left by the developer when building the code.

Pattern: .pdb로 끝나는 경로 문자열
Example Found: C:UsersDarkCoderProjectsRansomware_v2Releasepayload.pdb
👉 Analysis Point: The username (DarkCoder) or project name (Ransomware_v2) itself becomes a very strong family signature. Googling might reveal other malware from the same perpetrator!

C. Mutex and Unique Strings 🔒

Malware creates ‘mutexes’ to prevent duplicate execution. The more unique this name is, the better a signature it becomes.

Pattern: Unique and distinctive alphanumeric combination
Example Found: Global{A1B2C3D4-E5F6-7890-abcd-ef1234567890}, MyMalwareMutex_v1
👉 Analysis Point: Including this mutex name in detection rules can accurately catch that specific family.

D. Unusual Typos or Messages 📝

Hackers are human too. They make typos or leave their own unique messages.

Example Found: Unusual phrases in ransomware notes (All y0ur files are encrypted!), profanity or comments within the code
👉 Analysis Point: Typos or sentences never seen in normal programs are excellent signatures.

5. [Advanced] Noise Filtering using AI 🤖

If the extracted strings exceed 10,000 lines, it would be difficult to review them all manually, right? This is where our AI assistant (e.g., ChatGPT) can be utilized.

💡 AI Prompt Example:

“I have a list of strings extracted from malware. From the list below, exclude common Windows API functions or library names, and filter only suspicious strings (IP, URL, registry keys, file paths, unusual messages) that are likely related to malicious activity.”

(Paste string list here)

AI can quickly filter out normal system strings (noise) and significantly help narrow down the candidates that analysts should focus on.

🎉 Conclusion: This is the Beginning of Detection Rules!

The ‘unique strings’ extracted through today’s practice are not just simple text.

➡️ Network blocking policy
C:UsersDarkCoder…pdb ➡️ Key condition for YARA rule creation

Thus, a small string found by an analyst can become a powerful shield protecting the entire organization.

At first, you might only see garbage values, but if you keep looking, you’ll start to ‘smell’ the malware. Don’t give up and keep digging! You can do it! 💪