Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Malware Analysis for Beginners: Static and Dynamic Basics

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

When an incident involves a suspicious file, someone has to work out what it does: what it changes, who it talks to and how to detect it elsewhere. That is malware analysis. At entry level it is less about reverse engineering and more about safe, methodical observation.

Safety First

  • Analyze only in an isolated virtual machine, never on your normal computer or a work network
  • Snapshot the machine before you start and roll back afterward
  • Disable shared folders and clipboard sharing with the host
  • Store samples in password-protected archives, as analysts conventionally do
  • Follow your organization's rules on where samples may be uploaded

Static Analysis: Look Without Running

  • Hashes: calculate MD5 and SHA-256 and check them against reputation services; a known hash can answer the question in minutes
  • File type: confirm what the file really is, not what its extension claims
  • Strings: readable text inside the file can reveal URLs, IP addresses, file paths, commands and error messages
  • Structure: for Windows executables, the imported functions hint at behavior (networking, encryption, process injection); packed files show few readable strings
  • Documents and scripts: Office macros, PowerShell and JavaScript can often be read directly once deobfuscated

Dynamic Analysis: Run It and Watch

Run the sample in the isolated machine, or in a sandbox service your team approves, and record what it does:

  • Processes it starts, and their command lines
  • Files it creates, changes or deletes
  • Registry keys it adds, especially for persistence
  • Network connections and DNS lookups it attempts
  • Services or scheduled tasks it creates

Sysmon and a network capture in Wireshark make this much easier. Some malware detects analysis environments and behaves differently, so a quiet run does not prove a file is safe.

Indicators of Compromise (IOCs)

The output is a list of indicators others can use: hashes, domains, IP addresses, file paths, registry keys, mutex names. Hash and IP indicators are easy for attackers to change, so also describe the behavior, which makes better detections. Network indicators are easiest to capture with Wireshark. Mapping behavior to MITRE ATT&CK helps.

Where It Fits in Incident Response

Malware analysis feeds the containment and eradication steps: what to block, which machines to check, what persistence to remove. See incident response steps explained.

Learning Malware Analysis

In our SOC analyst, Splunk, Wazuh and DFIR course, malware analysis is taught inside the DFIR module: you examine suspicious files and extract indicators of compromise as part of an investigation. For deeper forensics, EC-Council's CHFI is a natural next step.

Want to see how a suspicious file is investigated? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →
Intermediate to advanced · EC-Council certification

Computer Hacking Forensic Investigator (CHFI)

Investigate incidents and handle digital evidence properly.

₹37,000 + GST

  • Evidence acquisition
  • Disk and OS forensics
  • Network and cloud forensics
  • Reporting
View the certification →
Advanced · EC-Council certification

Certified Incident Handler (ECIH v3)

When the alert is real. Respond, investigate and recover.

₹34,000 + GST

  • Incident response
  • Digital forensics
  • Malware analysis
  • Legal compliance
View the certification →

More Guides

SOC and blue team · 2 min read

Incident Response Steps Explained: From Alert to Lessons Learned

The incident response lifecycle explained: preparation, detection and analysis, containment, eradication, recovery and lessons learned, plus DFIR evidence basics.

Read the guide →
SOC and blue team · 3 min read

Splunk vs Wazuh: Which Should a SOC Beginner Learn First?

Splunk or Wazuh? What each tool does in a SOC, how they differ, which appears in job listings, and how a beginner can practice both in a home lab.

Read the guide →
SOC and blue team · 2 min read

What Is MITRE ATT&CK? A Beginner's Guide for SOC and Red Teams

MITRE ATT&CK explained: tactics, techniques and sub-techniques, how SOC analysts map detections to it, how red teams use it, and how to start learning it.

Read the guide →
SOC and blue team · 2 min read

What Is Threat Hunting? A Beginner's Guide for SOC Analysts

Threat hunting explained: how it differs from alert triage, hypothesis-driven hunts, example hunts on Windows, the data you need and how hunts become detections.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp