Malware Analysis Basics Cheat Sheet
Introduces static and dynamic malware analysis techniques, common tools, and safe sandboxing practices for examining suspicious files.
2 PagesAdvancedFeb 5, 2026
Analysis Approaches
The two fundamental categories of malware analysis.
- Static analysis- Examine the file without executing it (strings, headers, hashes, disassembly)
- Dynamic analysis- Execute the sample in a controlled environment and observe its behavior
- Basic static- File hashing, string extraction, header inspection, no code execution or reversal
- Advanced static- Disassembly/decompilation to understand actual code logic
- Behavioral (dynamic)- Monitor file system, registry, network, and process activity during execution
Basic Static Triage Commands
Quick, safe first steps before deeper analysis.
bash
# Compute hashes to check against threat intel (VirusTotal, etc.)sha256sum suspicious.exemd5sum suspicious.exe# Identify file typefile suspicious.exe# Extract printable strings (look for URLs, IPs, commands)strings -n 8 suspicious.exe | less# Inspect PE headers (imports, sections)objdump -x suspicious.exe# Check for known-bad signatures with YARAyara rules.yar suspicious.exe
Common Malware Analysis Tools
Widely used tools by analysis category.
- Static/PE inspection- PEStudio, CFF Explorer, Detect It Easy (DiE)
- Disassembly/decompilation- Ghidra, IDA Pro, Binary Ninja
- Dynamic/sandbox- Cuckoo Sandbox, Any.Run, ProcMon + Process Explorer
- Network analysis- Wireshark, INetSim (fake internet services for isolated sandboxes)
- Signature matching- YARA rules for identifying known malware families
Safe Handling Practices
Precautions required before and during analysis of live malware.
- Isolated sandbox/VM- Never analyze live malware on a production or internet-connected host
- Snapshot before execution- Take a VM snapshot so the environment can be reverted after each run
- Disable/simulate network access- Use a fake internet (INetSim) to observe C2 attempts without real harm
- Handle as read-only- Keep original sample write-protected; work from copies
- No shared network shares- Prevent malware from spreading to host or other systems via shared folders
Detecting Packing & Obfuscation
Packed samples need unpacking before disassembly reveals real logic.
bash
# High entropy sections (~7.5+ out of 8) strongly suggest packing/encryptionyara -r peid_packer_signatures.yar suspicious.exe# Detect It Easy CLI mode for packer/compiler fingerprintingdiec -e suspicious.exe# Check section entropy directlypython3 -c "import pefile, mathpe = pefile.PE('suspicious.exe')for s in pe.sections: data = s.get_data() if data: ent = -sum((data.count(b)/len(data)) * math.log2(data.count(b)/len(data)) for b in set(data) if data.count(b)) print(s.Name.decode().strip('\\x00'), round(ent, 2))"# Dump unpacked memory image once the sample decrypts itself (breakpoint at OEP)# then reconstruct the import table with tools like Scylla/ImpREC
Mapping Behavior to MITRE ATT&CK
Translate observed sample behavior into standardized technique IDs for reporting and detection engineering.
- T1055 Process Injection- Sample writes/executes code inside another process's address space (e.g. via VirtualAllocEx + WriteProcessMemory)
- T1547 Boot/Logon Autostart- Registry Run keys, scheduled tasks, or services used for persistence
- T1027 Obfuscated Files- Packing, string encryption, or control-flow flattening to evade static detection
- T1071 Application Layer Protocol (C2)- HTTP/HTTPS/DNS beaconing to a command-and-control server
- T1140 Deobfuscate/Decode- Sample decrypts embedded payloads or config at runtime (e.g. XOR-encoded strings)
- T1562 Impair Defenses- Attempts to disable AV/EDR, clear event logs, or unhook API monitoring
Spotting Sandbox/VM Evasion Logic
Static indicators that a sample is checking for an analysis environment before detonating.
text
# Strings commonly present in anti-analysis checks (search with `strings -n 6`)VMwareVBoxQEMUSbieDll.dll # SandboxieSbieSvcdbghelp.dll # sometimes indicates anti-debug tooling loaded by the sample# API calls to grep for in disassembly (Ghidra 'Search > For Strings' / imports)IsDebuggerPresentCheckRemoteDebuggerPresentGetTickCount # timing-based sandbox detection (sleep-and-compare)CPUID # hypervisor bit check (leaf 1, ECX bit 31)NtQuerySystemInformation # process/DLL enumeration for analysis tools# If timing checks are suspected, patch Sleep() calls or use a sandbox that# accelerates virtual time (e.g. Cuckoo's time-skip) rather than fighting each check
Extracting Network IOCs from a Sample
Pull C2 domains, IPs, and URLs safely for threat intel without live detonation.
bash
# Extract candidate URLs/domains/IPs from strings outputstrings -n 8 suspicious.exe | grep -Eo '(https?://[^ "]+)|([0-9]{1,3}\.){3}[0-9]{1,3}'# Decode common obfuscation before extracting (Base64, XOR single-byte key sweep)for key in $(seq 1 255); do xxd -p suspicious.bin | tr -d '\n' | \ python3 -c "import sys; d=bytes.fromhex(sys.stdin.read()); print(bytes(b^$key for b in d))" \ | grep -aoE 'https?://[a-zA-Z0-9./_-]+' && echo "key=$key"done 2>/dev/null# Cross-reference extracted indicators against threat intel before blockingcurl -s "https://otx.alienvault.com/api/v1/indicators/domain/<domain>/general" \ -H "X-OTX-API-KEY: $OTX_API_KEY"
Pro Tip
Always check a sample's hash against VirusTotal and threat intel feeds before spending hours on manual reverse engineering — many samples are already-known commodity malware with published analysis reports.
Was this cheat sheet helpful?
Explore Topics
#MalwareAnalysisBasics#MalwareAnalysisBasicsCheatSheet#Cybersecurity#Advanced#AnalysisApproaches#BasicStaticTriageCommands#CommonMalwareAnalysisTools#SafeHandlingPractices#CheatSheet#SkillVeris
