Malware Analysis

What is Malware Analysis?

Malware analysis is the process of examining malicious software to understand its behaviour, identify indicators of compromise (IoCs) and develop detection and neutralisation methods. It is a key element of incident response and threat intelligence.

Malware analysis operates at three levels. Static analysis - examining the sample without executing it: extracting strings, analysing PE headers, identifying imported API functions, checking signatures and entropy. Dynamic analysis - running the malware in a controlled environment (sandbox) and observing its behaviour: file creation, registry modifications, network communication, code injection. Code analysis (reverse engineering) - disassembly and decompilation to understand programme logic at the CPU instruction level.

Tools used in malware analysis include disassemblers (IDA Pro, Ghidra), debuggers (x64dbg, WinDbg), sandboxes (ANY.RUN, Cuckoo Sandbox), static analysis tools (PE-bear, FLOSS) and threat intelligence platforms (VirusTotal, MISP).

Why does it matter?

Malware analysis answers critical questions during an incident: what does the malware do, what data may have been exfiltrated, what C2 server does it communicate with and how can it be detected across remaining systems. Results translate into detection rules (YARA, Sigma, Snort), indicators to block in security systems and threat intelligence reports for the community.

Related topics

• Reverse Engineering
• Sandbox
• YARA Rules