Learn how to secure networks, applications, and systems against digital threats.
Malware analysis is the defensive discipline of understanding what a malicious program does, how it does it, and how to detect and stop it. Analysts study malware in an isolated environment so they can extract indicators and build detections without ever executing it on a real system. This lesson covers malware categories, the malware lifecycle, static versus dynamic analysis, indicators of compromise, and the professional, safe workflow an analyst follows. You will learn to reason about behavior and evidence, not to write malware. Everything here is defensive. You will analyze indicators and behaviors in controlled, hypothetical settings — never build or run real malware.
| Category | Behavior |
|---|---|
| Virus | Attaches to files and spreads when they run |
| Worm | Self-replicating across a network |
| Trojan | Disguised as legitimate software |
| Ransomware | Encrypts data and demands payment |
| Spyware | Collects information covertly |
| Rootkit | Hides its presence at a low level |
| Bot | Controlled remotely as part of a botnet |
Delivery brings the malware in (email, download, exploit). Execution runs it. Persistence keeps it alive across reboots. The objective is what the attacker ultimately wants.
| Static Analysis | Dynamic Analysis | |
|---|---|---|
| Runs the code? | No | Yes (in a sandbox) |
| Examines | Hash, strings, imports, metadata | Processes, files, registry, network |
| Strength | Safe, fast, broad | Reveals actual behavior |
| Limit | Misses packed/obfuscated behavior | May not trigger all paths |
A hypothetical analysis of a suspicious file.
(static + dynamic evidence together tell the story)
Given the IOCs, what kind of malware is it?
(behavior, not the file name, determines the category)