Malware analysis is the systematic examination of malicious software to understand its behavior, purpose, and impact on compromised systems. Operating at the intersection of reverse engineering, forensics, and threat intelligence, it empowers security teams to detect, classify, and respond to cyber threats. This discipline combines static analysis (code inspection without execution), dynamic analysis (runtime behavior observation), and hybrid approaches that leverage both—while navigating an arms race where adversaries deploy sophisticated evasion, obfuscation, and anti-analysis techniques to avoid detection. One critical insight: malware rarely acts in isolation—understanding behavioral patterns, persistence mechanisms, and network indicators reveals not just what a sample does, but the broader campaign or actor behind it.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 196 indexed concepts, 184 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Static Analysis Techniques
Static analysis is the safe first look—everything you can learn from a sample without ever letting it run. From hashing and string extraction to entropy checks and PE header inspection, these techniques surface URLs, suspicious imports, and signs of packing fast, shaping how you approach the deeper analysis that follows.
| Technique | Example | Description | |
|---|---|---|---|
certutil -hashfile malware.exe MD5sha256sum malware.bin | • Generates cryptographic fingerprints (MD5, SHA-1, SHA-256) for unique malware identification and database lookups • easily defeated by trivial modifications | ||
ssdeep malware.exessdeep -m 95 sample1 sample2 | • Uses context-triggered piecewise hashing (CTPH) to detect similar but modified samples by comparing structural patterns • effective against polymorphic variants | ||
strings -a -n 8 malware.exestrings -el malware.bin | Extracts printable ASCII/Unicode text revealing embedded URLs, IP addresses, registry keys, and hardcoded commands. | ||
python -c "import math; ..."PEStudio entropy score: 7.2 | • Measures randomness in binary sections • high entropy (>7.0) indicates encryption or packing, low entropy suggests uncompressed code | ||
dumpbin /headers malware.exePEview: check timestamps | Examines DOS header, NT headers, section tables, and import directories for compilation time, architecture (x86/x64), and suspicious discrepancies. | ||
dumpbin /imports malware.exeIDA Pro: View → Open subviews → Imports | • Lists Windows API functions the malware calls • reveals capabilities like network access (WinHTTP), file manipulation (CreateFile), or process injection (VirtualAllocEx). | ||
dumpbin /exports malware.dllCheck export names in PEStudio | • Identifies functions a DLL exposes • malware often hides malicious exports with benign names or uses ordinals without names. | ||
PEStudio: Sections tab Check .text, .data, .rsrc sizes | • Examines section permissions and characteristics • writable .text sections or executable .data sections are red flags • oversized .rsrc may hide payloads | ||
exeinfo pe malware.exepython detect-it-easy.py sample | • Uses signature databases to identify packers (UPX, Themida, ASPack) or obfuscation layers • entropy and section naming patterns provide secondary indicators | ||
Resource Hacker: open .rsrc PEStudio: Resources tab | • Analyzes embedded icons, dialogs, images, and binary data • malware hides configuration, exploits, or secondary payloads in resources | ||
yara rules.yar malware.execlamav --scan-file=sample | • Compares binary patterns against YARA rules or antivirus signatures • effective for known malware families but blind to zero-days. | ||
exiftool malware.exeCheck OriginalFilename, CompanyName | • Extracts version info, digital signatures, and build timestamps • adversaries spoof legitimate metadata to appear trustworthy |