Key takeaway
Separate observations from interpretation. Connect static and dynamic findings to the incident context, then validate detection and response actions.
What an analysis should deliver
Malware analysis establishes what a sample does, which data and systems it affects, how it communicates and what traces it leaves. The output should be reproducible evidence for investigation, detection rules and concrete response actions.
Sample identity
Record the file hash, format, size, collection location and time.
Behavior and impact
Connect processes, file and registry changes, network connections and persistence mechanisms.
Defensive output
Deliver indicators with context; test detection, blocking and recovery measures and assign their owners.
Static, dynamic and code-level analysis
Choose the method around the investigation question. File structure, observed execution and code logic reveal different aspects of the same sample.
| Method | What it reveals | What to account for |
|---|---|---|
| Static analysis | Strings, metadata, imports, file structure and potential addresses without execution. | Packing, encryption and obfuscation may hide content; a string alone does not prove behavior. |
| Dynamic analysis | Processes, system changes and traffic during controlled execution. | Requires isolation and instrumentation. A sample may recognize a sandbox, delay activity or wait for further input. |
| Reverse engineering | Code logic, malicious functionality, encryption and command-and-control (C2) mechanisms examined using disassemblers, decompilers and debuggers. | Requires architecture and programming expertise; can combine static inspection and controlled dynamic debugging. |
Start with static inspection
Work on a copy of the sample. Inspect its actual format, headers, sections, signature information and imports; extract relevant strings, URLs, domains and IP addresses. Hash reputation can guide initial triage. Distinguish an address in the code from an observed network connection. If packing or encryption hides content, define the question that deeper analysis must answer.
Observe execution in an isolated environment
Prepare an analysis environment with a suitable OS and controlled network. Preserve the baseline, then record the process tree, file and registry changes, created services and tasks, DNS requests and connections. Report the start time, observation duration and inputs supplied to the sample. An inactive run does not establish safety: time, user actions and environment can influence behavior.
Memory evidence
Authorized memory collection helps investigate running processes, loaded modules and data that may not be present on disk.
Network context
Correlate controlled traffic captures with DNS, address, time and process; lab policy should govern access to real external infrastructure.
When deeper code analysis is needed
When static findings and sandbox observations leave a question unanswered, a specialist examines control flow and API calls. A disassembler exposes machine instructions; a decompiler provides an approximate higher-level representation. A debugger follows state changes during controlled execution. The aim is to explain hidden functionality, configuration, encryption or a control channel and connect the finding to a reproducible observation.
From sample to defensive action
Follow evidence-preservation and incident-response procedures. Each stage should produce a clear handoff to the next team.
Intake and registration
Record authorization, provenance, hash and storage; preserve the original.
Initial triage
Use format, metadata, strings and reputation to set priority and the investigation question.
Controlled analysis
Select static, dynamic, memory and network methods; record tool and environment versions.
Correlation
Compare lab findings with the incident timeline and endpoint telemetry.
Report and validation
Document observations, indicators and response actions; validate rules against malicious and benign samples.
Response and improvement
Feed findings into containment, removal, patching and recovery plans; update rules and operating procedures.
Practical questions
Use these distinctions when choosing a method and applying the results.
Is an antivirus scan a complete analysis?
A scan provides initial reputation and detection findings. A full investigation explains behavior, impact, related evidence and response actions.
How does obfuscation affect method selection?
It can conceal strings and code logic. Complement static findings with controlled execution and, where needed, reverse engineering.
Why might a sandbox show no activity?
A sample may recognize the environment, require another file or user action, or delay execution. Record the environment and observation period.