Strings Extraction & Analysis

Purpose: Extract human-readable text from binaries to discover URLs, file paths, commands, error messages, encryption keys, and other intelligence — without executing the binary.

---

1. Quick Commands

FLOSS (FireEye Labs Obfuscated String Solver) — Best Tool

# Basic extraction (includes deobfuscated strings)
floss fileName.exe

# Check the FLOSS static unicode strings at the bottom
# These often contain the most interesting artifacts

# Output to file for easier searching
floss fileName.exe > strings_output.txt

# Verbose mode (see decoding attempts)
floss -v fileName.exe

# Minimum string length (default is 4)
floss -n 8 fileName.exe

Traditional strings Command

# ASCII strings (default)
strings fileName.exe

# Unicode strings (Windows uses UTF-16LE)
strings -e l fileName.exe

# Both ASCII and Unicode
strings -a fileName.exe && strings -e l fileName.exe

# Set minimum length (reduce noise)
strings -n 8 fileName.exe

# With byte offset (useful for locating in hex editor)
strings -t x fileName.exe

---

2. FLOSS vs strings — Why FLOSS Wins

Feature	strings	FLOSS
ASCII strings	Yes	Yes
Unicode strings	With -e l flag	Automatic
Decoded/deobfuscated strings	No	Yes
Stack strings (built char-by-char)	No	Yes
Tight strings (XOR decoded)	No	Yes
Speed	Very fast	Slower (does emulation)
Install	Pre-installed	pip install floss or download binary

FLOSS uses emulation to actually execute string decoding routines, revealing strings that strings can never find.

Install FLOSS

# Via pip
pip install floss

# Or download binary from GitHub
# https://github.com/mandiant/flare-floss/releases

---

3. What to Look For in String Output

High-Value String Categories

Category	Example Strings	Intelligence
URLs / Domains	http://evil.com/gate.php, api.telegram.org	C2 servers, exfil endpoints
IP Addresses	192.168.1.100, 10.0.0.1:4444	C2 IPs, callback addresses
File Paths	C:\Users\Public\payload.dll, /tmp/.hidden	Drop locations
Registry Keys	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Persistence mechanisms
Commands	cmd.exe /c, powershell -enc, whoami, net user	Execution commands
API Names	VirtualAlloc, CreateRemoteThread	Dynamic API resolution
DLL Names	kernel32.dll, ntdll.dll, ws2_32.dll	Loaded libraries
Error Messages	Connection failed, File not found	Developer debug messages
Crypto Constants	-----BEGIN RSA PUBLIC KEY-----	Encryption usage
User Agents	Mozilla/5.0..., Go-http-client/1.1	HTTP fingerprint
Mutex Names	Global\MyMutex123	Singleton check
Base64 Blobs	SGVsbG8gV29ybGQ=	Encoded payloads/configs
Passwords / Keys	admin:password123, AES_KEY=	Hardcoded credentials
Developer Artifacts	C:\Users\dev\Desktop\malware\	Attacker machine info

---

4. String Analysis Methodology

Step-by-Step Workflow

1. Run FLOSS on the sample
   └── floss sample.exe > floss_output.txt

2. Sort by categories using grep
   └── grep -iE "http|https|ftp|\.com|\.net|\.org" floss_output.txt
   └── grep -iE "\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" floss_output.txt
   └── grep -iE "HKLM|HKCU|CurrentVersion|Run" floss_output.txt
   └── grep -iE "cmd|powershell|exec|system|shell" floss_output.txt
   └── grep -iE "password|credential|login|token|key" floss_output.txt

3. Decode any Base64 strings
   └── echo "SGVsbG8gV29ybGQ=" | base64 -d

4. Extract IOCs (Indicators of Compromise)
   └── IPs, domains, file hashes, mutex names, file paths

5. Cross-reference with threat intelligence
   └── VirusTotal, MalwareBazaar, OTX

Useful grep Patterns for Malware Analysis

# Network indicators
grep -oP 'https?://[^\s"<>]+' floss_output.txt
grep -oP '\b\d{1,3}(\.\d{1,3}){3}\b' floss_output.txt
grep -oP '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b' floss_output.txt

# Windows paths
grep -oP '[A-Z]:\\[^\s"]+' floss_output.txt

# Registry keys
grep -iP '(HKLM|HKCU|HKCR)\\[^\s"]+' floss_output.txt

# Base64 encoded strings (min length 20)
grep -oP '[A-Za-z0-9+/]{20,}={0,2}' floss_output.txt

# Potential encryption keys (hex strings)
grep -oP '\b[0-9a-fA-F]{32,}\b' floss_output.txt

---

5. Obfuscated Strings — What FLOSS Catches

Stack Strings

Malware builds strings one character at a time on the stack to avoid detection:

// In the binary (no complete strings visible to `strings`)
char s[20];
s[0] = 'c'; s[1] = 'm'; s[2] = 'd'; s[3] = '.';
s[4] = 'e'; s[5] = 'x'; s[6] = 'e'; s[7] = '\0';

FLOSS emulates this and recovers cmd.exe

XOR-Encoded Strings

char encoded[] = {0x2C, 0x37, 0x37, 0x30, 0x1A}; // XOR 0x5C = "http:"
for(int i=0; i<5; i++) encoded[i] ^= 0x5C;

FLOSS tries common XOR keys and recovers the plaintext

RC4 / Custom Encrypted Strings

More complex decryption routines — FLOSS emulates the decoder function to recover strings

---

6. Advanced String Techniques

Extract Strings from Specific PE Sections

# Only .rdata section (constants, string literals)
objdump -s -j .rdata malware.exe | strings

# Only .data section (global variables)
objdump -s -j .data malware.exe | strings

# Resource section (often contains payloads)
objdump -s -j .rsrc malware.exe | strings

String Diffing Between Samples

# Compare strings between two variants
floss variant_a.exe > strings_a.txt
floss variant_b.exe > strings_b.txt
diff strings_a.txt strings_b.txt

# Or use comm to find unique/common strings
sort strings_a.txt > a_sorted.txt
sort strings_b.txt > b_sorted.txt
comm -12 a_sorted.txt b_sorted.txt > common_strings.txt  # Shared
comm -23 a_sorted.txt b_sorted.txt > only_in_a.txt        # Unique to A

Strings in Memory Dumps

# Extract strings from a memory dump
strings -n 10 memory_dump.dmp > mem_strings.txt

# Search for specific patterns in memory
strings memory_dump.dmp | grep -iE "(password|http|cmd\.exe)"

---

7. Related Tools

Tool	Description	Use Case
FLOSS	Deobfuscating string solver	Primary tool for malware strings
strings	Basic string extraction	Quick first pass
Bstrings (Eric Zimmerman)	Enhanced strings for Windows	Better Unicode, regex support
binwalk	Firmware/embedded file analysis	Find embedded files & strings
foremost	File carving	Extract files from binary blobs
yara	Pattern matching	Scan for known string signatures
StringSifter	ML-based string ranking	Prioritize interesting strings

StringSifter — AI-Powered String Ranking

# Ranks strings by maliciousness likelihood
pip install stringsifter
floss sample.exe | rank_strings
# Output: most suspicious strings first

---

Pro Tips

Always run FLOSS, not just strings — You’ll miss 30-50% of interesting strings with the basic strings command.

Check FLOSS decoded strings section — The bottom section labeled “FLOSS decoded strings” and “FLOSS stack strings” contains the real gold — these are strings the malware tried to hide.

Pipe to less or save to file — Large binaries can have thousands of strings. Save output and search systematically.

Combine with entropy analysis — High-entropy sections with few strings = likely packed/encrypted. Low-entropy sections are worth deep string analysis.