Static analysis reduces risk before you run anything. Use it to form a hypothesis, then decide whether dynamic analysis is justified in an isolated lab.
First-pass workflow
- Hash — SHA-256 (and MD5/SHA-1 only if a source still indexes them). Record hashes in notes before renaming files.
- File type —
file, magic bytes, and packing hints. Treat mismatches between extension and type as suspicious. - Strings — ASCII/Unicode strings for URLs, paths, registry keys, and commands. Prefer filtered views over dumping everything into chat.
- Headers & imports — PE/ELF structure, sections, import tables. Note anomalous section names or high entropy.
- Classify — family/behavior hypotheses only with evidence; mark confidence (low/medium/high).
What static analysis is not
It does not prove runtime behavior. Packers, obfuscation, and delayed payloads can hide intent until dynamic analysis in a controlled environment.
Lab hygiene reminder
Keep samples offline from production networks. Prefer snapshots and host-only networking. Never upload sensitive customer binaries to public sandboxes without authorization.
static-analysistriage
Published 14 Oct 2026. External links open destinations outside CyberCrew — verify them before use in workshops.