What is malware analysis?
Malware analysis is the process of studying a malicious sample to understand what it does, how it does it and what traces it leaves. The goal is not technical curiosity: it is obtaining indicators of compromise to hunt the threat across the rest of the organization, determining whether data was stolen, and responding with facts instead of assumptions.
Static and dynamic: what each is for
Static analysis examines the sample without running it — strings, headers, sections, imports, signatures — and is fast and safe, but packing and obfuscation limit it. Dynamic analysis runs the sample in an isolated environment and observes real behavior: which files it touches, which registry keys it changes, which domains it talks to. The norm is combining both, resorting to reverse engineering with a disassembler only when both fall short.
The lab and its precautions
Work happens in isolated virtual machines, with snapshots to return to a clean state, no access to the production network and controlled or simulated internet egress. Modern malware detects analysis environments — checking for low RAM, few cores, debugging tools or virtualization drivers — and changes behavior or stays dormant to avoid revealing itself. A report concluding 'it does nothing' usually means the sample spotted the lab.
