Defensive guide

Malware Analysis for Beginners: Tools and Workflow

Malware analysis is examining a suspicious file to learn what it does and how to detect it. Beginners start with static triage (hashes, strings, file structure), then watch behaviour in an isolated sandbox, then write down indicators and detections that defenders can use.

This guide is defensive. It covers how to analyse safely and what to produce; it does not explain how to write or modify malware, and nothing here is a build recipe.

Updated 3 November 2026

Static vs dynamic analysis

	Static	Dynamic
Runs the sample?	No	Yes, in an isolated lab
You learn	File type, hashes, readable strings, imported functions, structure	Files, processes and registry changes, network connections
Main risk	Low if you never open it	Escape or leakage if the lab is not isolated
Weakness	Packed or encrypted content hides detail	Samples can detect sandboxes or wait before acting

A safe lab

Use a virtual machine that is not your daily system, with no shared folders, no clipboard sharing and no route to your real network.
Take a snapshot before each run and revert after it.
Keep samples in a password-protected archive or defanged form until you are inside the lab.
Record what you do as you do it: the notes are the report later.
If you analyse for an employer, follow their handling policy and chain of custody. The forensics lab practises the evidence-handling side.

A defensive workflow

Triage. Record file name, size and cryptographic hashes. Check whether the hash is already known to public reputation services before doing more.
Static look. Identify the file type, read the strings, list imported functions and note anything packed or obfuscated.
Behaviour. Detonate in a sandbox and note process, file, registry and network activity.
Network. Capture traffic: domains resolved, servers contacted, protocols used. Practising on public packet captures is the easiest way to learn this.
Map and extract. Map behaviours to MITRE ATT&CK techniques and list indicators of compromise.
Detect and report. Turn indicators and behaviours into detection ideas, state scope and confidence, and recommend containment. Feed indicators to your threat intelligence process.

NIST SP 800-83 covers malware incident prevention and handling, and SP 800-61 places analysis inside the incident response lifecycle.

Tools beginners meet first

Hashing and file-type tools to identify and look up a sample.
A strings extractor and a header viewer for static triage.
A hosted or self-run sandbox for behaviour.
Wireshark for packet captures.
Ghidra, a free reverse engineering framework, for later-stage disassembly. If you use AI help on samples, read AI reverse engineering safety first.

Learn what each tool's output means before adding the next. A tool you cannot interpret adds noise.

Malware traffic analysis

Reading a packet capture from an infected host is the gentlest start: no live malware, just a file. Look for unusual DNS lookups, connections to servers the host never normally contacts, regular beacon-like timing and unexpected protocols. Write the findings as a timeline with host, time and evidence, the same format an incident report uses. A SOC role uses this skill daily; see the SOC analyst career guide.

Frequently asked questions

What is malware analysis?

Malware analysis is examining a suspicious file or process to work out what it does, how it got in and how to detect and contain it. The output is defensive: indicators of compromise, detection rules, a scope of impact and a report. It is part of incident response and threat intelligence work.

What is the difference between static and dynamic malware analysis?

Static analysis inspects a sample without running it: file type, hashes, strings, imports, structure. Dynamic analysis runs it in an isolated environment and watches behaviour: files written, registry and process activity, network connections. Analysts usually start static, then run dynamic analysis in a sandbox to confirm.

How do I analyze malware safely?

Never on your normal computer or network. Use an isolated virtual machine with no shared folders and no route to your real network, take a snapshot before every run, handle samples only inside it, and keep the sample in an archive or defanged form when you move it. Work from samples published for training or from an organisation's approved process, not from files you downloaded to see what happens.

What tools do beginners use for malware analysis?

Common starting points are hash and file-type tools, a strings extractor, a PE or ELF header viewer, a disassembler or decompiler such as Ghidra (free, released by the US NSA), a hosted sandbox for behaviour, and Wireshark for network traffic. Learn what each output means before adding more tools.

What is malware traffic analysis?

It is reading packet captures from an infected host to see how malware communicates: which domains it resolves, which servers it contacts, what it sends and when. It is a good beginner skill because you work from a capture file and need no live malware. Public packet-capture exercises exist for practice.

Do I need to know programming for malware analysis?

Not to start. Static triage and traffic analysis need networking and operating-system knowledge. Reverse engineering needs reading assembly and a programming language over time, so treat it as a later step.

Is it legal to analyze malware?

Analysing samples you are authorised to handle is normal defensive work. Writing, modifying or distributing malware is a different matter and is not covered here. Laws differ by country, so follow your employer's or course's rules and do not handle samples from systems you do not own or have permission to examine.