Malware Analysis & Reverse Engineering

Malware analysis is the structured, defensive study of malicious software to understand its behaviour and purpose so you can detect, remove, and defend against it. The output is indicators of compromise, detection rules, and clear reports. Analysts never reuse a sample against real targets; the work exists to stop malware, not spread it.

Run an analysis virtual machine inside a hypervisor, set its network to host-only or disconnected so it cannot reach the internet or your LAN, install your tools, and take a clean snapshot. Detonate samples only inside that VM, then revert to the snapshot afterward so every analysis starts fresh.

Static analysis examines a file without running it, looking at hashes, strings, headers, and imported functions. Dynamic analysis runs the sample in a controlled, instrumented environment and watches what it actually does. Static shows what a sample could do; dynamic shows what it does on a given run. Analysts use both together.

A properly isolated VM with host-only networking is the standard practice, but it is not foolproof. Some malware detects virtualisation, and VM-escape bugs exist though they are rare. That is why you also keep the VM off your real network and revert snapshots after each run, combining several layers of protection rather than relying on one.

Record its cryptographic hash, such as SHA-256, and its origin before you touch the file. The hash gives the sample a stable identity for tracking and sharing, and the origin provides provenance. Both are essential so your later report is trustworthy and others can reproduce your findings.

A PE file's import table lists the DLLs and functions it calls, which hints at its capabilities before you run it. Networking APIs suggest it talks on the wire, crypto APIs suggest encryption, and the VirtualAllocEx, WriteProcessMemory and CreateRemoteThread trio suggests code injection. The combination, not any single import, tells the story.