Static malware analysis examines malicious software without executing it, relying on inspection of the file's structure, code, metadata, and embedded artifacts. This approach is safer than dynamic analysis because the malware never runs, eliminating the risk of accidental infection or environment contamination. Static analysis ranges from basic techniques accessible to junior analysts to advanced reverse engineering requiring deep knowledge of assembly language, operating system internals, and cryptographic implementations.
Basic static analysis begins with file identification using magic bytes and file headers to determine the true file type regardless of extension. Hash values (MD5, SHA-256) are computed for database lookups against VirusTotal and other repositories. String extraction reveals embedded URLs, IP addresses, file paths, registry keys, and error messages. PE header analysis (for Windows executables) examines import tables, section characteristics, compilation timestamps, and packer signatures. Advanced static analysis involves disassembly with tools like Ghidra or IDA Pro, where analysts read assembly code to understand program logic. Signature-based detection using YARA rules matches byte patterns, strings, and structural characteristics across file collections.
Static analysis provides immediate triage capabilities without requiring a sandboxed execution environment. It can identify packed or encrypted payloads that would evade dynamic analysis, detect anti-analysis techniques before they activate, and extract indicators from samples that crash or require specific triggers to execute. Static analysis is also essential for analyzing malware designed to detect and evade sandbox environments. The indicators and signatures produced through static analysis enable rapid deployment of detection rules across an organization's security stack.
CDA teaches static analysis as the entry point into malware analysis within the TID domain, starting at the M2 Analyst certification level. Our C-HARDEN campaigns include static analysis of samples relevant to the client's threat landscape. CDA's wiki maintains YARA rule collections organized by malware family, and our operators contribute new rules as part of the intelligence production cycle.