Malware Analysis Cheat Sheet

Updated 2026-04-30

Next Topic: Malware Analysis Cheat Sheet

🧠Study flashcards on this topic135 cards · spaced repetition→

Malware analysis is the art and science of dissecting malicious software to understand its behavior, capabilities, and intent within the field of cybersecurity and digital forensics. It serves as a critical defensive practice, enabling security teams to respond to threats, build detection signatures, and prevent future attacks by revealing how adversaries operate. The key to effective malware analysis is understanding that static analysis reveals what the code contains, dynamic analysis shows what it actually does, and hybrid approaches combine both for comprehensive insight—this mental model helps analysts choose the right technique for each situation and ensures no critical behavioral indicators are missed.

What This Cheat Sheet Covers

This topic spans 19 focused tables and 166 indexed concepts, 135 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Core Analysis MethodologiesTable 2: Malware Types and FamiliesTable 3: Static Analysis TechniquesTable 4: Dynamic Analysis TechniquesTable 5 Reverse Engineering ToolsTable 6: Anti-Analysis and Evasion TechniquesTable 7: Code Injection and Process ManipulationTable 8: Memory Analysis TechniquesTable 9: Malware Persistence MechanismsTable 10: YARA Rules and Signature CreationTable 11: PE File Format InternalsTable 12: Network Analysis for MalwareTable 13: Malware Analysis Sandbox SystemsTable 14: Memory Forensics Tools and CommandsTable 15: Static Analysis Tools and UtilitiesTable 16: Advanced Malware TechniquesTable 17: Cryptographic Analysis in MalwareTable 18: Malware Classification and AttributionTable 19: Malware Analysis Best Practices

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Core Analysis Methodologies

Every malware investigation pivots on choosing the right approach for the sample in front of you. These are the six fundamental methodologies—from reading a binary without running it, to detonating it in a sandbox, to carving secrets out of RAM—and knowing what each one reveals (and where it goes blind) is what separates a quick triage from a wasted afternoon.

Method	Example	Description
Static Analysis	`strings malware.exe` `dumpbin /headers sample.dll`	• Examines malware without executing it by analyzing file structure, embedded strings, imports, and binary code • fast and safe but limited by obfuscation and packing
Dynamic Analysis	Execute in sandbox + monitor with `Procmon` Capture network with `Wireshark`	• Observes malware behavior in a controlled environment by executing it and monitoring file operations, registry changes, network traffic, and process activity • reveals true capabilities but can miss time-delayed or environment-aware behaviors
Hybrid Analysis	Static triage → dynamic execution → reassess with new findings	• Combines static and dynamic techniques iteratively to handle complex samples that evade single-method analysis • starts with static identification, executes dynamically, then refines understanding with additional static examination
Memory Forensics	`volatility -f memdump.raw pslist` `volatility malfind -p 1234`	• Analyzes volatile RAM contents to uncover fileless malware, injected code, decrypted payloads, and process anomalies that never touch disk • critical for detecting memory-resident threats that traditional methods miss
Behavioral Analysis	Monitor API calls with `API Monitor` Track IOCs in real-time	• Focuses on actions malware performs rather than its code structure • identifies malicious intent through patterns like credential theft, ransomware encryption, or C2 communication regardless of how the code is written
Code Reversing	Disassemble with `IDA Pro` or `Ghidra` Decompile to pseudo-C	• Reconstructs program logic from compiled binaries through disassembly and decompilation • enables deep understanding of algorithms, encryption routines, and anti-analysis techniques but requires significant expertise

Table 2: Malware Types and Families

Classifying a sample by what it is meant to do is the first thing an analyst settles—a banking trojan, a worm, and ransomware demand very different defensive responses. The rows here pair each category with the real-world families that defined it, so you can recognise the behavioural fingerprint when you see it in your own logs.

Type	Example	Description
Trojan	Zeus, Emotet, TrickBot	• Disguises itself as legitimate software to gain initial access • often delivers secondary payloads or provides backdoor capabilities for remote attackers

The rest of this section is part of the full cheat sheet

Table 3: Static Analysis Techniques

Before you ever run a sample, there's a surprising amount you can learn just by inspecting the file itself. These techniques range from hashing for instant threat-intel lookups, to pulling strings and imports, to spotting packing through entropy—the fast, safe first pass that shapes everything you do next.

Technique	Example	Description
File Hashing	`Get-FileHash sample.exe -Algorithm SHA256` `md5sum malware.bin`	• Generates cryptographic hash (MD5, SHA-1, SHA-256) as unique fingerprint • enables quick identification through lookup in threat intelligence databases like VirusTotal

The rest of this section is part of the full cheat sheet

Table 4: Dynamic Analysis Techniques

Static analysis tells you what the code contains; running it tells you what it actually does. These techniques watch a live detonation from every angle—file and registry changes, API calls, network beacons, memory snapshots—turning a packed, obfuscated binary into an observable list of behaviours.

Technique	Example	Description
Sandbox Execution	`Cuckoo Sandbox`, `ANY.RUN`, `Joe Sandbox`	• Executes malware in isolated virtual environment while monitoring all system interactions • automated platforms provide detailed reports on behavior, network activity, and dropped files

The rest of this section is part of the full cheat sheet

Table 1: Core Analysis Methodologies

Method	Example	Description
Static Analysis	`strings malware.exe` `dumpbin /headers sample.dll`	• Examines malware without executing it by analyzing file structure, embedded strings, imports, and binary code • fast and safe but limited by obfuscation and packing
Dynamic Analysis	Execute in sandbox + monitor with `Procmon` Capture network with `Wireshark`	• Observes malware behavior in a controlled environment by executing it and monitoring file operations, registry changes, network traffic, and process activity • reveals true capabilities but can miss time-delayed or environment-aware behaviors
Hybrid Analysis	Static triage → dynamic execution → reassess with new findings	• Combines static and dynamic techniques iteratively to handle complex samples that evade single-method analysis • starts with static identification, executes dynamically, then refines understanding with additional static examination
Memory Forensics	`volatility -f memdump.raw pslist` `volatility malfind -p 1234`	• Analyzes volatile RAM contents to uncover fileless malware, injected code, decrypted payloads, and process anomalies that never touch disk • critical for detecting memory-resident threats that traditional methods miss
Behavioral Analysis	Monitor API calls with `API Monitor` Track IOCs in real-time	• Focuses on actions malware performs rather than its code structure • identifies malicious intent through patterns like credential theft, ransomware encryption, or C2 communication regardless of how the code is written
Code Reversing	Disassemble with `IDA Pro` or `Ghidra` Decompile to pseudo-C	• Reconstructs program logic from compiled binaries through disassembly and decompilation • enables deep understanding of algorithms, encryption routines, and anti-analysis techniques but requires significant expertise

Table 2: Malware Types and Families

Type	Example	Description
Trojan	Zeus, Emotet, TrickBot	• Disguises itself as legitimate software to gain initial access • often delivers secondary payloads or provides backdoor capabilities for remote attackers

Table 3: Static Analysis Techniques

Technique	Example	Description
File Hashing	`Get-FileHash sample.exe -Algorithm SHA256` `md5sum malware.bin`	• Generates cryptographic hash (MD5, SHA-1, SHA-256) as unique fingerprint • enables quick identification through lookup in threat intelligence databases like VirusTotal

Table 4: Dynamic Analysis Techniques

Technique	Example	Description
Sandbox Execution	`Cuckoo Sandbox`, `ANY.RUN`, `Joe Sandbox`	• Executes malware in isolated virtual environment while monitoring all system interactions • automated platforms provide detailed reports on behavior, network activity, and dropped files