What is Malware Analysis?
Malware analysis is the process of examining malicious software to understand how it works, what it does to an infected system, and how it communicates with attacker-controlled infrastructure. The findings inform everything from detection signatures and incident response decisions to threat actor attribution and long-term defensive strategy. Analysts use a combination of automated tools, controlled execution environments, and manual code inspection to build a complete picture of a sample's capabilities and origin.
How Malware Analysis Works
Malware analysis follows a general progression from less invasive to more intensive techniques. A sample may not require all of them as initial analysis often reveals enough to act on, but complex or evasive malware typically demands depth.
The process usually begins with triage: identifying the file type, generating a hash, querying known threat databases, and doing a quick behavioral scan. From there, analysts move into either static or dynamic analysis (or both), then deeper reverse engineering if the situation warrants it.
Throughout the process, the analyst maintains an isolated environment to prevent the malware from reaching live systems, exfiltrating data, or communicating with attacker infrastructure in ways that compromise the investigation.
Types of Malware Analysis
Static Analysis
Static analysis examines a malware sample without executing it. Analysts inspect the file's structure, strings, imports, metadata, and embedded resources. Common tools include disassemblers, hex editors, and string extraction utilities. Static analysis is fast, safe, and good at identifying obvious capabilities such as hardcoded C2 addresses, encryption keys, file paths, and embedded payloads. But sophisticated malware can use obfuscation, packing, and encryption to defeat static analysis.
Dynamic Analysis
Dynamic analysis executes the malware in a controlled environment and observes its behavior: what files it creates or modifies, what registry keys it touches, what network traffic it generates, and what processes it spawns. This approach reveals what the malware actually does at runtime, which static inspection may miss. A malware sandbox automates much of this process, capturing behavioral telemetry without requiring an analyst to monitor every action manually.
Hybrid Analysis
Hybrid analysis combines static and dynamic techniques to compensate for the blind spots in each. Static findings guide dynamic investigation. For example, identifying a suspicious function that's then watched closely during execution. Dynamic observations prompt deeper static work when behavior doesn't match the visible code. Most production malware analysis workflows blend both.
Manual Reverse Engineering
For high-priority samples or sophisticated threats, analysts perform manual reverse engineering: disassembling or decompiling the binary, reading assembly or pseudo-code, and mapping the malware's full logic. This is the most time-intensive technique and requires deep expertise, but it produces the most complete understanding. It's standard practice for nation-state malware, advanced persistent threat (APT) tooling, and zero-day exploits where understanding every capability matters.
Why Malware Analysis Matters
Malware analysis converts unknown threats into understood ones. A hash in a threat feed tells you a file is malicious; analysis tells you what it does, who likely built it, how it communicates, and whether it's part of a broader campaign. That difference is operationally significant.
For incident responders, analysis determines the scope of a compromise. If a sample exfiltrates credentials silently before deploying ransomware, responders need to know that. And they need to know it before scoping containment. Analysis also identifies persistence mechanisms, so responders can confirm full remediation rather than cleaning the obvious artifacts and leaving a backdoor in place.
For threat intelligence teams, malware analysis produces the behavioral signatures and actor attribution that intelligence programs depend on. Indicators derived from analysis such as YARA rules, network signatures, and behavioral fingerprints are more durable than hash-based detection because they persist across the minor variations attackers use to burn existing indicators.
For security architects and detection engineers, analysis findings translate directly into detection content: new rules, updated signatures, and behavioral analytics that catch the next variant of a known family before it executes successfully.
How to Build an Effective Malware Analysis Capability
- Start with automation. A malware sandbox handles triage and initial dynamic analysis at scale, generating behavioral reports for every sample without requiring an analyst per file. Automation handles volume; human expertise handles depth.
- Maintain isolated environments. Analysis infrastructure should be air-gapped or network-controlled to prevent live C2 contact and cross-contamination. Snapshots allow rapid environment reset between samples.
- Build a sample repository. Storing analyzed samples with structured metadata like family, behavior, attribution, and campaign tags builds institutional knowledge over time and speeds future analysis of related variants.
- Develop RE expertise. Static analysis and reverse engineering skills are hard to scale through automation alone. Investing in analysts who can read assembly and understand obfuscation techniques creates a capability that fully automated tools can't replicate.
- Integrate findings into detection. Analysis findings should have a clear path into the tools that use them. YARA rules, Sigma signatures, and threat intelligence enrichment should flow from analysis output into production detection infrastructure with minimal friction.
ZeroFox's threat intelligence program incorporates malware analysis as part of its broader CTI capability, with 100+ in-house and affiliated analysts working across dark web monitoring, malware research, and actor attribution to surface actionable intelligence across the 12B+ signals ZeroFox monitors daily.
Malware Analysis vs. Malware Sandbox
A malware sandbox is a tool that automates dynamic analysis by executing samples in a controlled environment and generating behavioral reports. Malware analysis is the broader practice that encompasses static analysis, dynamic analysis, manual reverse engineering, and the human judgment that contextualizes findings. A sandbox accelerates malware analysis (particularly at triage scale), but doesn't replace the analyst work required to interpret results, identify evasion, and build intelligence from findings. Most serious analysis workflows use both.
Related Terms
For related concepts, see Malware, Malware Sandbox, Malware Threat Intelligence, and Threat Intelligence.