Malware analysis basics for defenders: static, dynamic and sandboxes

Why defenders analyse malware

When a suspicious file turns up in an email or on a laptop, the incident team needs answers fast. Is it malicious? What does it do? Did it steal data? What should we block? Malware analysis answers those questions. It also feeds threat intelligence: the domains, file names and behaviours you find become indicators that protect you and, if shared, other organisations.

Common malware types include trojans (disguised as something useful), ransomware (encrypts files for a ransom), infostealers (grab saved passwords and browser cookies), worms (spread by themselves), remote access trojans (give an attacker control) and loaders (download other malware).

Static analysis

Static analysis examines the file without running it, so it is safe to start with.

• Hash the file (SHA-256) and check it against your intelligence sources and reputation services. Try the hash tool to see how hashes work.
• Identify the real file type from its header, not its name. An "invoice.pdf" that is really an executable is a strong warning sign.
• Extract readable strings: web addresses, IP addresses, registry paths and error messages often reveal intent.
• Check signatures and metadata: is the file digitally signed, and by whom? When was it compiled?

Attackers often pack or obfuscate malware so these checks reveal little. That is when dynamic analysis helps.

Dynamic analysis and sandboxes

Dynamic analysis runs the sample in a controlled environment and watches what it does: which processes it starts, which files and registry keys it changes, and which addresses it contacts. A sandbox automates this, producing a report within minutes. Many email gateways and EDR products include one, and they are the quickest option for most SOCs.

Some malware detects sandboxes and stays quiet, so a clean sandbox report does not prove a file is safe. Treat it as one piece of evidence.

Working safely and sharing results

1. Analyse only in an isolated lab: a virtual machine with no shared folders, no access to your real network and a snapshot to roll back to.
2. Never upload confidential documents to public scanning sites; the file may become visible to others.
3. Store samples in password-protected archives and label them clearly.
4. Record indicators (hashes, domains, file paths) and behaviours mapped to ATT&CK.
5. Write detections. YARA is a widely used rule language that describes patterns in files, so you can scan for the same malware family elsewhere.

Tip: follow your organisation's policy on handling malware. Deep reverse engineering is a specialist skill; know when to pass a sample to an expert or your security vendor.

Real-world example: a suspicious invoice at a builders' merchant

A finance clerk at a fictional builders' merchant reports an email with an attached "overdue invoice" archive. The analyst hashes the file: no matches in the threat intelligence platform. Static checks show the archive contains a script disguised with a double extension. In the email gateway's sandbox the script launches PowerShell, contacts an unfamiliar domain and drops a file in a temporary folder, behaviour typical of a loader. The analyst blocks the domain and hash, purges the email from all mailboxes, searches EDR data to confirm nobody ran it, and shares the indicators with the company's industry sharing group under TLP:GREEN.