Malware Analysis, Static and Dynamic

What it is

Malware analysis is the study of a malicious file to learn what it does, how it persists, what it connects to and how to detect and remove it. For the SOC, the main output is indicators of compromise (IoCs): hashes, domains, IP addresses, file names, registry keys and behaviors to block and hunt for.

Static analysis examines the file without running it. Dynamic analysis runs it in an isolated environment and watches what it does.

How it works

Why and where analysis is done

Analysis happens in a sandbox or a dedicated lab: virtual machines isolated from the production network, with snapshots to roll back after each run. Malware may detect virtual machines and change behavior, so analysts make the lab look like a real system.

Static analysis techniques

Windows executables use the Portable Executable (PE) format. Common sections include .text (code), .data (initialized data), .rdata (read only data) and .rsrc (resources). Imports such as networking or process injection functions hint at capabilities.

High entropy and very few readable strings usually mean the file is packed. A packed sample often needs dynamic analysis to see its real behavior.

YARA rules from static findings

A YARA rule describes a malware family by strings or byte patterns and a condition. It is valid syntax like this:

rule Example_Dropper
{
    strings:
        $a = "evil-c2.example" ascii
        $b = { 4D 5A }
    condition:
        $b at 0 and $a
}

Here 4D 5A is the "MZ" header of a PE file at offset 0, and the rule matches when that header and the domain string are both present. SOCs use YARA rules to scan endpoints and file stores for the same family.

Dynamic analysis techniques

Automated sandboxes such as Cuckoo Sandbox (open source) and online services like ANY.RUN or Joe Sandbox run the sample and produce a behavior report. Analysts still review the report, because evasive malware may sleep or check for a virtual machine first.

Static versus dynamic

Most analysis uses both: static first for quick facts, then dynamic to confirm behavior.

A worked example

EDR quarantines an invoice attachment. The analyst hashes it, finds no match in reputation services and sees high entropy with few strings, suggesting packing.

In a sandbox the sample unpacks, writes itself to a user folder, adds a Run registry key and beacons to a domain every five minutes. The SOC blocks the hash and domain, writes a YARA rule and hunts for the registry key on all endpoints.

How the exam asks about this

• "Which analysis type examines a file's hash, strings and imports without executing it?" → Static analysis.
• "A sample shows high entropy and almost no readable strings. What is the likely reason?" → It is packed or obfuscated.
• "Which tool compares registry snapshots taken before and after running a sample?" → Regshot.