Malware Analysis Basics

Malware analysis is figuring out what a malicious file does and how to detect it. It splits into static analysis, examining the file without running it, and dynamic analysis, running it in an isolated environment and watching its behaviour. The absolute first rule is a safe, isolated lab, because you are handling live malware.

Static vs dynamic analysis

Real analysis uses both: static to form a hypothesis, dynamic to confirm it.

Static analysis, what to look for

• Strings: URLs, IP addresses, file paths, commands
• Imports: which system functions it calls hints at capability
• File type and headers: what it really is versus what it claims
• Hashes: to check against threat intelligence
• Packing: obfuscation that hides the real code

Dynamic analysis, what to watch

Run the sample in the isolated lab and observe what changes:

• Files created, modified or deleted
• Registry changes on Windows
• Processes spawned
• Network connections, the command and control channel
• Persistence mechanisms it sets up

The goal: indicators and detection

Analysis is not just curiosity. The output is indicators of compromise, hashes, domains, file paths, that let a SOC detect the same malware elsewhere, and detection rules built from the behaviour. This connects directly to SOC work and threat intelligence.

The career path

Malware analysis sits on the defensive and research side. It requires patience, an understanding of operating system internals, and eventually reverse engineering skill. It is a specialisation you grow into from SOC or forensics, rarely a first job.

Practise this safely

Start with deliberately safe samples and educational malware in a proper isolated lab, never live malware on a real machine. Build the lab first, sample second. Related discipline: digital forensics.