# What is Malware Analysis?

> Malware analysis is the authorized examination of suspected malicious software or related artifacts to determine their structure, capabilities, behavior, indicators, dependencies, and potential impact.

- Canonical URL: https://yellowcube.eu/glossary/malware-analysis/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Static analysis studies an artifact without executing it; dynamic analysis observes execution in a controlled environment. Analysts often combine automated triage, behavioral observation, code examination, and incident evidence because each method reveals different facts.

The goal determines the depth of work. Rapid incident triage may seek containment indicators, while deeper analysis may explain persistence, communications, data access, evasion, or code lineage. Conclusions should distinguish observations, tool interpretations, and analyst inferences.

### Key points

- **Static evidence:** Hashes, file format, strings, imports, embedded content, signatures, packing clues, and code structure can guide identification without running the sample.
- **Dynamic evidence:** Controlled observation can reveal processes, files, memory activity, configuration changes, network attempts, and behavior that static inspection missed.
- **Safe handling:** Use an authorized, isolated analysis environment with restricted connectivity, controlled sample storage and transfer, snapshots or rebuilding, and documented evidence handling.
- **Important limitation:** One method or run rarely reveals every capability. Packing, encryption, dormant logic, required inputs, environmental checks, sandbox evasion, tool errors, and destructive behavior can hide or distort results; an uneventful run does not prove safety.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Digital forensics and incident response (DFIR)](<https://yellowcube.eu/glossary/digital-forensics-and-incident-response/>) · [Indicator of compromise (IoC)](<https://yellowcube.eu/glossary/indicator-of-compromise/>) · [Sandboxing](<https://yellowcube.eu/glossary/sandboxing/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>)

### Sources

[NIST IR 8428: Digital Forensics and Incident Response Framework for Operational Technology](https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8428.pdf) · [Mandiant FLARE Learning Hub](https://github.com/mandiant/flare-learning-hub)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.