Security Operations · Intermediate

Static Malware Analysis

Examining a malware sample without executing it, using file properties, strings, headers and disassembly.

Definition

Static analysis includes hashing the file, checking it against threat intelligence, examining PE headers, imports, strings, resources and entropy, and disassembling code with tools such as Ghidra or IDA. It is safe because the code never runs but can be defeated by packing and obfuscation.

Related terms