Quick answer: Malware analysis is examining a suspicious file in a controlled environment to understand what it does, how it spreads and how to clean it. There are four basic approaches: static analysis (looking inside without running it), dynamic analysis (running it in an isolated environment and watching its behavior), sandbox (observing it automatically in a safe sandbox) and reverse engineering (decoding the code step by step). The goal is two questions: "What did this do?" and "Who else was affected?" The output of analysis is concrete indicators to use in defense: which files, which addresses, which registry keys point to the malware. These are called IOCs (Indicators of Compromise) and are used to scan the whole network.

When an organization faces ransomware or spyware, the first question is panic: "What happened?" The second is more important: "How far did it spread?" Malware analysis answers both with evidence, not by guessing but by observing what the file actually does. This article explains the four approaches, how to build a safe analysis environment and how analysis connects to defense.

The four analysis approaches

Approach What it does Strength Limit
Static Inspects without running Safe, fast first look Encrypted/packed code stays hidden
Dynamic Runs in an isolated environment Shows real behavior Environment aware malware hides
Sandbox Observes automatically Scale, speed, report Bypassed by evasion techniques
Reverse engineering Decodes the code Deepest understanding Needs time and expertise

Static analysis

The file is examined without running it. File type, hash, embedded strings, system calls used and signatures are checked. YARA rules are used here to match known malware families. Static analysis is safe because the code never runs, but modern malware is often packed or encrypted, so it is not enough alone.

Dynamic analysis

The file is run in a network isolated virtual machine and its behavior is watched: which files it created, which registry keys it changed, which addresses it tried to reach. This shows the malware's intent. For what happens in memory, RAM analysis with Volatility is complementary.

Sandbox

A sandbox automates dynamic analysis. The file is dropped into a safe sandbox, and system behavior and network traffic are reported automatically. It provides speed and scale, but advanced malware can detect the sandbox and stay dormant, so it is not used as the only evidence.

Reverse engineering

The deepest method. The code is decoded step by step with a disassembler and debugger. The malware's encryption logic, command and control protocol and evasion techniques are only fully understood here. It needs time and expertise, usually for targeted or new threats.

A safe analysis environment

Malware analysis is dangerous; a badly built environment lets the malware escape. Basic rules:

  • Isolation. Analysis is done in a virtual machine, fully separated from the corporate network. The malware must not spread by accident.
  • Snapshot. A clean snapshot is taken before each run, then reverted to.
  • Network control. Traffic is monitored, but unauthorized access to the real internet is blocked.
  • Evidence integrity. The sample's hash is recorded; this is required for the digital chain of custody.

From analysis to defense: IOCs

The real value of analysis is in the concrete indicators it produces. The traces a malware leaves are used to scan the whole network:

  • File indicators: hashes, file names, paths.
  • Network indicators: domains and addresses it tried to reach.
  • System indicators: registry keys, tasks, services it created.

These indicators are fed into the SIEM and SOC system to answer "which other machine connected to this address." In a ransomware incident this draws the real boundary of the spread. Analysis and response feed each other within the incident response playbook.

Frequently asked questions

Why analyze if antivirus is present? Antivirus catches known malware. New or targeted malware is unsigned; only analysis shows what it did and where it spread.

Can I run the malware on my own computer to see? No. Malware must be run in an isolated, revertible environment. Running it on a machine connected to the corporate network can be a disaster.

Is a sandbox enough alone? Good for speed, but advanced malware detects the sandbox and hides its behavior. Static, dynamic and, when needed, reverse engineering are used together.

What are IOCs for? They let you search a malware's traces across the whole network. So from one infected machine you can detect the full spread.

Sources

To determine the impact and spread of a malware incident with evidence, produce IOCs and scan your network, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide digital forensics and incident response.