Malware › Module 1 › Lesson 1
What Malware Analysis Is
Malware analysis examines malicious code safely to support detection and IR — literacy on $MAL_LAB, never unknown samples on your daily driver.
Visual · mal_what_malware_analysis
Malware analysis literacy. $MAL_LAB only. Original Cyberlium.
Opening
Malware analysis answers what it is, what it does, and what defenders should hunt — not how to build harm.
Malware analysis is the disciplined study of malicious software to extract indicators, understand behavior, and improve defenses. Analysts combine static review (file structure, strings, hashes) with dynamic observation in isolated sandboxes. The goal is detection value and incident response — not weaponization. Cyberlium Topic 22 teaches analysis literacy on $MAL_LAB VMs you control with legally sourced samples. You will NOT run unknown downloads on your laptop, share live samples in chat, or treat analysis as malware authorship. Next: Sandbox First.
1. Static vs dynamic analysis (named)
Static analysis inspects a sample without executing it — file type, hashes, strings, PE/ELF headers, imports. Dynamic analysis runs the sample in an isolated sandbox and observes process, file, registry, and network activity.
Professional workflows use both: static triage first to decide if dynamic detonation is warranted on $MAL_LAB. Neither replaces the other — static is fast; dynamic confirms behavior.
Command guide
Try these commands — Static vs dynamic analysis (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Malware Analysis intro — https://malwareunicorn.org/workshops/malwareanalysis101.html (literacy, no sample download) Practical Malware Analysis — https://nostarch.com/malware (book literacy — lab-only mindset) ANY.RUN docs — https://any.run/malware-trends/ (sandbox literacy, use public reports only) EICAR test file — https://www.eicar.org/ (benign AV test string for YOUR lab)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Malware analysis: static/dynamic on benign lab samples only')"
curl -sS https://malwareunicorn.org/workshops/malwareanalysis101.html | head -8
curl -sS -o /dev/null -w "ANY.RUN docs HTTP %{http_code}
" https://any.run/malware-trends/Primary tools to practice this lesson: python3, curl. Reference sites: Malware Analysis intro (https://malwareunicorn.org/workshops/malwareanalysis101.html); Practical Malware Analysis (https://nostarch.com/malware); ANY.RUN docs (https://any.run/malware-trends/); EICAR test file (https://www.eicar.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Who performs analysis and why
SOC analysts triage alerts; malware researchers map families; IR teams scope breaches; detection engineers write YARA and SIEM rules. Output feeds threat intel, blocklists, and playbooks — not attack campaigns.
Cyberlium assumes YOU are building defender literacy on $MAL_LAB with samples from legal training sources — MalwareBazaar with account, theZoo intentionally, or YOUR org IR samples under policy.
3. What this topic will never call practice
Double-clicking unknown attachments on your daily driver, detonating Discord-shared binaries, building ransomware, or spreading samples to classmates. Those harm people and violate law — not homework.
Ship a sentence: malware analysis here means safe triage and sandbox literacy on MY $MAL_LAB with legal samples only. Next lesson: Sandbox First.
4. What you ship: malware analysis definition scoped to $MAL_LAB
Write static vs dynamic in one line each. Dest = $MAL_LAB sandbox VM. NEVER daily driver, unknown downloads, or weaponization. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Malware analysis definition. Lab = $MAL_LAB. NEVER daily driver detonation. Path: $HOME/cyberlium-lab/t22-m01-l01-what-malware-analysis.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run a random Discord.exe on your laptop 'to learn analysis.' Share live samples in class chat without policy.
Right
Define malware analysis and name $MAL_LAB as the only execution environment. Next: Sandbox First.
Mission: define malware analysis for YOUR lab
1) Write static vs dynamic in one paragraph each. 2) Write a NEVER list (daily driver, unknown downloads, ransomware authorship, sharing live samples). 3) Name $MAL_LAB as your placeholder. Never execute samples outside YOUR sandbox.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: static vs dynamic?' — not how to run unknown binaries.
Knowledge Check
APPLY: Malware analysis on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Static analysis requires executing the sample.
True or False
Knowledge Check
APPLY: Analysis output should primarily feed:
Multiple choice