What is malware analysis?
Malware analysis is the process of examining malicious software to understand how it works, what it does, and how to detect and stop it. By dissecting a sample's code, structure, and behavior, analysts determine its purpose, capabilities, and potential impact, then extract the indicators of compromise (IOCs) needed to hunt for it and defend against it. The output turns an unknown suspicious file into actionable knowledge that feeds directly into incident response, threat intelligence, and detection engineering. Three core approaches cover most scenarios: static analysis (examining a file without running it), dynamic analysis (executing it safely in a sandbox to observe its behavior), and hybrid analysis (combining both). For the most advanced samples, reverse engineering goes deeper still.
Key takeaways
- The goal is actionable understanding: Malware analysis reveals what a sample does and produces IOCs and detection logic to find and block it elsewhere.
- Three core approaches: Static (no execution), dynamic (execution in a sandbox), and hybrid (both), each with distinct strengths and blind spots.
- Sandboxing is central to safe analysis: Suspicious code is detonated in an isolated environment so it can't infect production systems.
- Reverse engineering is the deep end: Disassemblers and debuggers such as Ghidra and IDA Pro reconstruct a sample's logic when triage isn't enough.
- Modern malware fights back: Packing, obfuscation, polymorphism, and sandbox evasion are built specifically to defeat analysis, which is why hybrid and behavioral methods matter.
Why malware analysis matters
When an organization suspects a compromise, malware analysis answers the questions that drive every decision that follows: is this file actually malicious, what family does it belong to, what does it do, what has it touched, and how do we detect and remove it everywhere else?
The output feeds directly into practical defense. It produces IoCs (file hashes, IP addresses, domains, registry keys) that can be blocked and hunted across the estate. It informs detection engineering, letting teams write signatures and behavioral rules that catch the sample and its variants. It supports incident response by scoping the damage and revealing persistence and command-and-control (C2) mechanisms. It enriches threat intelligence, connecting a sample to known campaigns, tooling, and threat actors. Without analysis, a suspicious file is just an alert. With it, it becomes coverage.
The types of malware analysis
Static analysis
Static analysis examines a file without executing it, making it a safe first step. Analysts inspect properties and structure: file names, hashes, embedded strings, PE header data, imported functions, and technical indicators like IP addresses, domains, and library references. Disassemblers and network analyzers can reveal how the code is built without running it.
It's fast and low-risk, excellent for triage and extracting quick IoCs. Its main limitation is that because the code never runs, sophisticated malware can hide runtime behavior, and packing or obfuscation can make the file unreadable until it's unpacked.
Dynamic analysis
Dynamic analysis executes the suspected sample in a sandbox, a secure, isolated virtual environment where analysts can watch what it actually does without risking production systems. By observing behavior (files created, processes spawned, registry changes, and network connections to C2 infrastructure), analysts capture what static analysis can't: the malware's real runtime actions.
Advanced malware may detect the sandbox and stay dormant (sandbox evasion), or depend on a live C2 server or a specific environment that isn't present, so it never reveals its full behavior.
Hybrid analysis
Hybrid analysis combines static and dynamic techniques to get the complete picture and defeat the evasion each method suffers alone. A common pattern is to apply static analysis to data generated during execution: examining the changes a running sample makes in memory, for instance, lets analysts catch malicious code that tries to hide and extract far more IoCs, including from previously unseen code. Hybrid analysis is the most effective approach against sophisticated and unknown threats, at the cost of more time and compute.
The stages of malware analysis
Analysts work in escalating levels of depth, spending only as much effort as the context requires.
- Identification and triage. Confirm whether a file is actually malicious and gather basic information (hash, file type, size). Often a quick check against VirusTotal or existing intelligence answers the question without deeper work.
- Static properties analysis. Examine hashes, strings, headers, and imports for known patterns or unusual elements. A near-empty import table or high section entropy signals a packed file that must be unpacked first.
- Dynamic (behavioral) analysis. Detonate the sample in a sandbox and observe altered processes, registry changes, and network activity to understand its payload and intent.
- Code analysis and reverse engineering. Dissect the code with disassemblers and debuggers to map its full logic and unique techniques. The most time-intensive stage, reserved for cases where deep understanding is genuinely needed.
Malware analysis tools and environment
Safe analysis starts with the environment, not the sample. Analysts work in a dedicated, isolated virtual machine with a clean snapshot to revert to after each detonation, and download malware directly to that machine rather than a production computer. Networking is often disabled by default and enabled only deliberately, with traffic monitored, since some samples need C2 contact to run fully.
For static work, tools like PEstudio, Detect It Easy (DiE), CFF Explorer, and radare2 inspect headers, imports, strings, and entropy, alongside packers' own utilities (such as UPX) for unpacking. Deeper reverse engineering relies on disassemblers and debuggers, most commonly Ghidra and IDA Pro, which translate machine code into readable form and, for dynamic debuggers, let analysts pause execution to inspect memory and variables. Pattern-matching frameworks like YARA turn what's learned into reusable detection rules.
Reverse engineering and anti-analysis techniques
Reverse engineering is the most advanced skill in malware analysis: understanding a compiled program's functionality without its source code. It's also where analysts confront the defenses malware authors build specifically to slow them down.
- Packing compresses or encrypts the real payload so only a small stub is visible until runtime. Packed samples show few imports and high entropy and must be unpacked first.
- Obfuscation deliberately scrambles code to make it unreadable.
- Polymorphic and metamorphic code changes its own form on each execution, so static signatures differ every time. Dynamic analysis is preferred against it: the code changes, but the objective usually doesn't.
- Anti-analysis and evasion techniques detect debuggers, virtual machines, or sandboxes and alter or halt behavior when they sense they're being watched.
The persistent gap between what a sample looks like and what it does is the core reason a single method is rarely enough.
Challenges of malware analysis
Malware analysis is hard, and it's worth being direct about why. The single biggest constraint is people: skilled analysts, and especially reverse engineers, are scarce. Most organizations struggle to staff this work. A thorough reverse-engineering effort can take enormous time and expertise, which is rarely practical for every suspicious file. Tooling often lacks automation and integration, making the process error-prone. And the adversary actively resists analysis through packing, obfuscation, and evasion.
Mature teams respond by triaging ruthlessly, automating the repetitive stages, and reserving deep manual analysis for the samples that genuinely warrant it. They also lean on shared intelligence so that work another researcher has already done doesn't have to be repeated.
Expert insight: From sample to detection, at scale
Individual how-to guides often miss the strategic point. Fast knowledge-to-protection conversion is where the real value lies: how quickly the findings from one analyzed sample become coverage across an entire fleet, and how much of that work you can avoid repeating. A brilliant reverse-engineering write-up that never turns into a detection rule protects no one. Teams that get this right treat analysis as a pipeline: triage fast, analyze deeply only when warranted, and convert every finding into reusable detection and shareable intelligence.
That pipeline is how Sekoia operates. Sekoia's in-house Threat Detection & Research (TDR) team performs deep malware analysis and reverse engineering, including on .NET malware and loaders, and publishes technical breakdowns of real families such as CustomerLoader and campaigns like the ChocoPoC RAT hidden in trojanized Python dependencies. That work converts into YARA rules built from multiple samples sourced from platforms like VirusTotal, and into detection content: roughly 1,000 rules mapped to MITRE ATT&CK, available in Sekoia Defend.
Sekoia Intelligence adds a telemetry engine that shows whether a given piece of malware and its associated IoCs have actually appeared in customer logs, turning a static analysis result into live prevalence and seasonality data, modeled in STIX 2.1 and enriched by the TDR team. An analyst doesn't start from zero on a known family. A newly analyzed sample becomes coverage across every monitored environment through the platform's 300-plus integrations. For European organizations, it comes with a data-sovereignty posture that US generalists rarely match.
Analyze what you must, automate the rest, and make sure every sample you dissect turns into detection that protects everyone, fast.
Frequently asked questions
What is malware analysis?
Malware analysis is the process of examining malicious software to understand its behavior, capabilities, and impact, and to extract the indicators of compromise and detection logic needed to defend against it. It combines static analysis, dynamic analysis, and reverse engineering, and it feeds directly into incident response, detection engineering, and threat intelligence.
What are the types of malware analysis?
There are three primary types. Static analysis examines a file without running it (properties, strings, headers, imports). Dynamic analysis executes the sample in a sandbox to observe its runtime behavior. Hybrid analysis combines both for complete coverage and to defeat evasion. Reverse engineering, dissecting the code itself, is the deepest form of analysis.
What is the difference between static and dynamic malware analysis?
Static analysis inspects the file without executing it: fast and safe, but it misses runtime behavior and is defeated by packing. Dynamic analysis runs the sample in an isolated sandbox to watch what it actually does, which reveals real behavior but can be thwarted by sandbox-evasion techniques. Most mature workflows use both.
What is a malware sandbox?
A sandbox is a secure, isolated virtual environment where analysts can execute suspected malware to observe its behavior without risking production systems or the wider network. It's the foundation of dynamic analysis, letting teams safely watch processes, file changes, and network connections to C2 infrastructure.
Is malware analysis the same as reverse engineering?
Not exactly. Reverse engineering, understanding a compiled program's logic without source code, is one part of malware analysis: its most advanced form. Malware analysis is broader, spanning quick triage, static properties review, dynamic sandbox execution, and reverse engineering. You often don't need full reverse engineering to reach a useful conclusion.