Malware and cyber defence, explained
What is malware analysis?
Malware analysis is the work of finding out what a malicious file does, how it does it, and how to detect and remove it. Analysts use two main approaches: static analysis, which examines the file without running it, and dynamic analysis, which runs it in an isolated lab and watches what it does. The results become detection rules and lists of indicators that protect everyone else.
Static analysis: reading the file without running it
Static analysis examines a file's contents without executing it, so it is safe and fast, and it is always the first step.
- Hashes identify the file exactly, so it can be looked up and shared. Our free file hash calculator works them out in your browser.
- File type comes from the first bytes, not the name: a Windows program starts with the letters MZ whatever its extension says.
- Strings, readable text inside the file, often give away addresses, file paths, commands and ransom notes.
- Imports list the operating system functions a program uses: functions for injecting into other processes or recording keys stand out.
- Packing: a file whose contents look random has probably been compressed or encrypted to hide its code.
Here is the start of a static triage in a few lines of Python, run against a harmless stand-in file built to look like a suspicious program. This is the output it printed:
import hashlib
import re
# A harmless stand-in for a suspicious file: random-looking bytes with a few
# readable strings inside, the way real programs carry them.
sample = (
b"MZ\x90\x00\x03\x00\x00\x00\x04\x00\xff\xff\x00\x00"
b"\x00\x13\x88GetProcAddress\x00LoadLibraryA\x00\x8f\x91"
b"http://update-check.example/api/v2/beacon\x00\x00\xa4"
b"Software\\Microsoft\\Windows\\CurrentVersion\\Run\x00\x7f"
b"\x02\x9cYour files have been encrypted\x00\x01\x02"
)
print("size ", len(sample), "bytes")
print("md5 ", hashlib.md5(sample).hexdigest())
print("sha256 ", hashlib.sha256(sample).hexdigest())
print("starts with MZ (Windows program):", sample[:2] == b"MZ")
print("strings of 6+ printable characters:")
for s in re.findall(rb"[\x20-\x7e]{6,}", sample):
print(" ", s.decode())
size 173 bytes
md5 464e73c076155a1b3798952c0ea1c17d
sha256 ffd51021cffe238694058818994c4339b9ae0c59ddf0e4500995b3e2b9792f96
starts with MZ (Windows program): True
strings of 6+ printable characters:
GetProcAddress
LoadLibraryA
http://update-check.example/api/v2/beacon
Software\Microsoft\Windows\CurrentVersion\Run
Your files have been encrypted
Five readable strings already tell a story: a Windows program (MZ) that loads code dynamically, contacts a web address, adds itself to the registry key that runs programs at login, and carries a ransom message. In a real case, that address and that registry key become indicators to hunt for on every other machine.
Dynamic analysis: watching it run
Dynamic analysis runs the sample in an isolated virtual machine, or an automated sandbox, and records everything it does.
Analysts watch for the files it creates, the registry keys it changes, the processes it starts and the network connections it tries. It reveals behaviour that static analysis cannot see, such as code that is only decrypted at run time. Its limit: some malware detects the lab and stays quiet, which is where the next level comes in.
Reverse engineering: reading the code
Reverse engineering turns the program back into readable logic with a disassembler or decompiler, so the analyst can see every branch, including the ones it never took in the lab.
Ghidra, released free by the US National Security Agency in 2019, and IDA are the best-known tools. This is the slowest and most skilled part of the job, used when defenders need the full picture: how its encryption works, whether there is a kill switch, every server it can contact.
What malware analysis produces
| Output | What it is | Who uses it |
|---|---|---|
| Indicators of compromise (IOCs) | Hashes, domains, IP addresses, file paths and registry keys the malware leaves | SOC analysts hunting across the network |
| Detection rules | YARA rules for files, behaviour rules for EDR | Security products and detection engineers |
| A report | What it does, how it got in, how to remove it | Incident responders and management |
| Technique mapping | Each behaviour labelled with its MITRE ATT&CK technique | Threat intelligence and defenders comparing attacks |
These outputs feed straight back into how antivirus detects malware and into EDR rules, and they guide the eradication step of incident response.
How to start learning malware analysis
- Learn the fundamentals first: what the main types of malware do, how operating systems run programs, and how networks work.
- Practise static analysis on harmless files: hash them, pull their strings, read their headers. Nothing runs, so nothing can go wrong.
- Build an isolated lab before you ever run anything: a virtual machine with no shared folders, networking switched to host-only, and a snapshot to roll back to.
- Use training material designed for learners, such as published exercises and analysis write-ups, before going near live samples.
- Write it up. Analysts are judged by their reports. Publishing your notes on practice samples is also the best portfolio for a first security job.
Questions people ask
Do you need to know programming for malware analysis?
To start, no: basic static and dynamic analysis use tools that show you what a file contains and does. To go deeper, reverse engineering, you need to read assembly language and usually some C and Python. Most analysts learn those along the way.
Is malware analysis a good career?
It is a specialist role that usually follows experience as a security operations (SOC) analyst or incident responder. The same skills are valued in threat intelligence, detection engineering and incident response, so learning them pays off even outside a dedicated analyst job.
Is it safe to analyse malware on my own computer?
Not directly. Analysis belongs in an isolated virtual machine with no shared folders, no connection to your real network, and a clean snapshot to roll back to. Beginners should start with training exercises and static analysis of files, which never runs anything.