static analysis
Analysis without running samples: PE header analysis (importing tables, sections), string extraction, decompilation (Ghidra, IDA Pro), hash lookup (VT). Quickly determine the type and family of malicious software.
dynamic analysis
Run samples in an isolated environment: sandboxes (Cuckoo Sandbox, Any. Run), monitor files/registry/network behavior, capture and analyze C2 communication, record process creation.
Common tools
PEview, CFF Explorer, Ghidra/IDA Pro (disassembly), x64dbg (debugger), Wireshark (packet capture), Process Hacker (process monitoring).
Behavioral report
Report content: Sample basic information (hash, size), classification (Trojan/worm/ransomware), behavior summary (file modification, network connection), IOC indicators (IP/domain name/registry path), and cleanup recommendations.
Disclaimer: Articles on this site come from original content, reposts, AI generation, and other sources. If there are copyright or other issues, pleaseclick here to feedback, and our company will verify and handle it promptly.