Extract contiguous printable ASCII and Unicode (UTF-16LE) character strings from executables, RAM dumps, disk images, or documents. Instantly isolate IP addresses, C2 domains, Windows paths, registry keys, and passwords with zero server upload.
Supports Windows Executables (.exe, .dll, .sys), Linux ELF, Mach-O, Office documents, PCAP packets, and memory dumps. Files are digested safely in your browser using chunked memory streaming.
| # | Offset (Hex) | Encoding | Length | Extracted String Content | Action |
|---|
In computer incident response and malware analysis, string extraction is universally acknowledged as the foundational first step of static examination. Rather than executing an untrusted specimen in a debugger or sandbox, forensic examiners parse contiguous sequences of printable characters embedded within the binary stream.
Executable binaries (PE, ELF, Mach-O), memory captures (RAM dumps), disk unallocated space, and even corrupted office documents contain human-readable indicators compiled into code or left in data sections. Extracting these character runs allows investigators to:
Identify hardcoded Command-and-Control (C2) domains, dynamic DNS hostnames, IP addresses, user-agent strings, and IRC/Telegram channels used for telemetry exfiltration.
Uncover scheduled task XML strings, startup registry run keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run), dropped payload paths (AppData\Roaming\...), and mutex names.
Extract PDB (Program Database) debugging symbols, build paths revealing developer usernames (e.g. C:\Users\actor\source\repos\...), and compiler versions.
A frequent pitfall for student examiners and novice analysts is running traditional GNU strings without encoding flags (e.g. executing only strings file.exe). Because standard Linux tools default strictly to 7-bit/8-bit ASCII, they miss the vast majority of internal Windows indicators.
The Windows operating system kernel, COM interfaces, and the Microsoft .NET CLR natively store text in UTF-16 Little Endian (UTF-16LE). In UTF-16LE, standard Latin letters are represented as two bytes: the ASCII character byte followed by a null byte (0x00). For example, the string "powershell.exe" is encoded as:
Because of the interleaved 0x00 bytes, standard ASCII scrapers reject the word as a series of 1-byte non-printable chunks. Our engine performs dual-pass byte scanning across both ASCII and UTF-16LE formats simultaneously.
| Artifact Type | Detection Regular Expression Pattern | Investigative Target |
|---|---|---|
| IPv4 Address | \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b |
Direct C2 beacon endpoints, staging proxies, and download servers. |
| Web URL | https?:\/\/[^\s"'<>]+ |
Phishing links, payload drop sites, and API webhooks. |
| Windows Path | [a-zA-Z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]* |
Dropped files, staging directories, PDB debug paths, and DLL targets. |
| Registry Key | (?:HKEY_LOCAL_MACHINE|HKLM|HKEY_CURRENT_USER|HKCU)\\[a-zA-Z0-9_\\]+ |
Persistence keys, security provider tampering, and autorun configurations. |
FileReader and DataView APIs to slice and parse binary bytes in local browser memory. Zero network requests containing file data are generated, guaranteeing complete chain-of-custody privacy.
requestAnimationFrame and Promises. This ensures the browser UI remains completely responsive and interactive even when scanning large binaries.