# Windows PE And .NET Playbook

Load this playbook for Windows EXE, DLL, driver, shellcode-like blobs, PE resources, and .NET assemblies.

## Tools

Preferred: `file`, hash tooling, `strings`, UTF-16 strings, `rg`, `yara`, `floss`, `xorsearch`, `objdump`/`llvm-objdump`, `rabin2`, `r2`, Python `pefile` and `lief`, `exiftool`, `7z`.

For .NET: `ilspycmd`, `monodis`, `dnSpyEx` when available on analyst workstation.

For deeper native reversing: Ghidra headless `analyzeHeadless`, `capa`, `upx`, `sigcheck`, `dumpbin` on Windows.

Ask before installing missing blocking tools. Use equivalent tooling when available.

## Workflow

1. Identify PE type, architecture, compiler/runtime, .NET status, subsystem, timestamp, signer, sections, entropy, overlay, imports, exports, resources, TLS, relocation anomalies, and packing indicators.
2. Extract ASCII and UTF-16 strings. Run `floss` for decoded strings and `xorsearch` for hidden URL/IP/domain/config material.
3. Search for URLs, domains, IPs, user agents, HTTP paths, Telegram bot tokens, `chat_id`, `api.telegram.org`, paste services, GitHub raw URLs, cloud storage, Tor/proxy strings, mutexes, registry paths, services, tasks, filenames, and command lines.
4. Inspect imports and xrefs for WinInet, WinHTTP, URLMon, sockets, DNS, Crypt/CNG/BCrypt, compression, process injection, persistence, anti-debug, anti-VM, service control, scheduled tasks, registry, WMI, PowerShell, and LOLBins.
5. Inspect resources, overlays, embedded archives, dropped binaries, scripts, certificates, icons, version info, and config blobs.
6. For .NET, decompile with `ilspycmd`; fall back to IL with `monodis` when source is obfuscated.
7. For native binaries, use `r2`, `rabin2`, `objdump`, and Ghidra headless to trace config decoding, network construction, unpacking, and stage loading.
8. Reconstruct XOR, RC4, AES, DES, RSA, custom rolling keys, Base64, compression, and string-table decoders with minimal deterministic scripts.
9. If a stage URL is authorized for retrieval, download it using parent request logic and analyze it as a new stage.
10. Save extracted resources, config blobs, decoder scripts, function notes, Ghidra/r2 outputs, stages, and IOCs.

## Edge Cases And Anti-Loop Rules

- Follow the core Token Budget And Anti-Loop Mode.
- Never execute PE, DLL, driver, shellcode, installer, or extracted payloads.
- If one parser fails, switch to `pefile`, `lief`, `rabin2`, `objdump`, `r2`, Ghidra, resources, overlays, or raw sections.
- Do not claim unpacking/decryption success unless the result has valid type, size, hashes, and observable content.
- Do not brute-force config keys broadly; identify key material, constants, loops, offsets, or crypto API usage first.
- For .NET, pivot between C#, IL, metadata, resources, and string decryptor reconstruction.

## Report Requirements

Include native/.NET/packed status, architecture, imports or APIs supporting behavior, C2/drop/stage URLs with origin, Telegram/API artifacts, config layout, decoder algorithms, persistence artifacts, anti-analysis, extracted stages with hashes, family candidates, confidence, and limits. If no C2 is found, state whether it may be runtime-derived and why.