Process and analysis
What is Static analysis?
Examining a file without running it, by reading its structure, strings, imports and code, to learn what it is and what it might do.
Static analysis examines a file without executing it. Basic static analysis looks at hashes, file type, strings, imports, sections, resources and signatures. Advanced static analysis reads the disassembled or decompiled code with tools such as Ghidra or IDA.
It is safe and often quick, and it can reveal capabilities the malware would not show in a short sandbox run. Packing and obfuscation limit what it can see, which is why it is usually paired with dynamic analysis.