Malware Analysis Fundamentals
RESEARCH

Malware Analysis Fundamentals

Abhishek MainaliAbhishek Mainali•DECEMBER 05, 2025•10 min read

Static vs Dynamic Analysis

Static analysis involves examining a malicious executable without actually running it, extracting strings and analyzing the PE header. Dynamic analysis requires executing the malware within a controlled sandbox like Cuckoo to observe behavioral modifications.

Always double-check your hypervisor network isolation settings. Many aggressive worms jump host boundaries if an accidental bridged connection is left enabled.

Extracting Strings

Malware authors often obfuscate code, but occasionally hard-coded IPs, domains, and API keys remain embedded in the binary in plain text. The `strings` utility is a foundational tool for initial triage.

bash
strings malicious.exe | grep -i 'http' > extracted_urls.txt

Disassembly and Decompilation

When basic analysis fails, reverse engineers load variants into Ghidra or IDA Pro to trace the execution flow. The focus is usually on unpacking routines. Here's roughly what jumping an OEP (Original Entry Point) looks like when tracing in python via `pefile`.

get_entry_point.py
python
import pefile

pe = pefile.PE('malware.exe')
ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint
print(f"Original Entry Point: {hex(ep)}")

Classifications

#malware#reverse-engineering#ghidra

Related Intelligence

Getting Started with Penetration Testing

Getting Started with Penetration Testing

MARCH 15, 2026

Understanding Active Directory Attacks

Understanding Active Directory Attacks

FEBRUARY 10, 2026

root@abhishek:~$ cat post_end.txt

// Thanks for reading. Connection terminated.

Malware Analysis Fundamentals | Abhishek Mainali