Understanding Malware Analysis

Malware analysis examines suspicious files or code to identify observable properties, likely capabilities, indicators, and behaviour while controlling risk.

What you will learn

By the end, you should be able to distinguish static and dynamic analysis, establish a safe handling boundary, and avoid unsupported attribution.

What is malware analysis?

Core concept

Static analysis examines a sample without intentionally executing it. Dynamic analysis observes behaviour in a controlled environment. Analysts often begin with hashes, type, structure, strings, imports, signatures, and rule matches before deciding whether execution is necessary.

HashesStructureStringsCapabilitiesBehaviour

Keep in mind: A detection name, packer, string, or rule match is a lead. It does not automatically prove malicious intent, family, actor, or campaign.

01Static analysisExamination without intentionally running the sample02Dynamic analysisObservation while the sample runs in a controlled environment03IndicatorAn observable value useful for investigation or detection

Analysis approaches

File triageType, size, hashes, signatures, and obvious characteristics

Static analysisStructure, imports, strings, rules, and likely capabilities

Dynamic analysisProcesses, files, Registry, memory, and network behaviour

Reverse engineeringDetailed code-level understanding

Why it matters

Triage safely

Static techniques can prioritise files without intentionally executing them.

Identify capabilities

Imports, strings, rules, and code can indicate likely functions.

Improve detection

Validated observables and behaviours can support searches and detection logic.

Guide response

Observed persistence, communications, and affected artefacts help scope investigation.

How malware analysis works

1. IsolateUse authorised, disposable analysis systems with controlled networking and no sensitive credentials.
2. PreserveHash, label, and retain the original sample in controlled storage.
3. TriageConfirm file type and inspect signatures, structure, strings, imports, and rule results.
4. Deepen carefullyUse capability analysis, unpacking, memory inspection, or controlled execution when justified.
5. ReportSeparate observed facts, likely capabilities, behaviour, indicators, and confidence.

Choose the next step

ScenarioYou receive an unknown executable attached to a case. What is the safest first analysis step?

Double-click it on the SUSA workstationHash and preserve it, then perform static triage in an isolated analysis workflowUpload it to every public analysis service

Select an answer to review the reasoning.

Escalate analysis deliberately

1. 1PreserveHash and control the original sample.
2. 2TriageStart with non-execution observations.
3. 3DeepenUse more intrusive methods only when justified.
4. 4QualifySeparate indicators, behaviour, and attribution.

!Control the analysis environment

Network escapeShared foldersCredentialsClipboardSnapshotsPublic uploads

Use a disposable lab and confirm organisational policy before sending any sample or evidence-derived data to an external service.

Malware-analysis tools in SUSA

Static triage

PEStudio

Inspect executable structure and suspicious characteristics without execution.

Capabilities

CAPA

Identify likely executable capabilities using descriptive rules.

Decoded strings

FLOSS

Extract and decode strings that may not appear in ordinary string output.

Continue learning

• Explore PEStudio for static triage.
• Explore YARA for rule-based identification.
• Explore CAPA for capability analysis.