Malware Analysis Cheat
Sheet (2025)
A fast reference for security analysts and incident responders. Updated for
2025 threats and analysis techniques. Focus: Efficiency and rapid
identification of key indicators.
by Bivash Kumar Nayak
Core Stages of Malware Analysis
There are three main phases: Static Analysis, Dynamic Analysis, and Reverse Engineering.
1
Static Analysis
Examine malware without execution.
2
Dynamic Analysis
Observe malware behavior in a
controlled environment.
3
Reverse Engineering
In-depth code analysis to understand
inner workings.
1. Static Analysis: Initial Triage
Purpose: Quick overview to identify basic characteristics.
File Hashing
Identify known malware families
using VirusTotal.
File Type Identification
Determine file type (PE, ELF, Mach-
O).
Strings Extraction
Extract URLs, IP addresses,
filenames.
Static Analysis: Deeper Dive
Purpose: Uncover hidden information and potential functionality.
Header Analysis
Check import/export tables for
suspicious functions.
Section Analysis
Look for unusual section names, sizes,
or permissions.
Resource Analysis
Extract and analyze embedded
resources.
Static Analysis: Identifying
Obfuscation
Purpose: Detect and understand obfuscation techniques.
1 Entropy Analysis
High entropy may indicate encryption or compression.
2 Packer Detection
Identify packers. Unpack malware if possible.
3 String Obfuscation
Look for unusual string patterns or encoding.
Static Analysis Tools: Quick
Reference
A list of static analysis tools for malware analysis.
PE Studio
Comprehensive PE file
analysis.
IDA Pro
Disassembler and
debugger.
strings
Extract embedded
strings.
VirusTotal
Multi-engine malware
scanning.
Static Analysis: Reporting
and IOC Generation
Purpose: Document findings and create actionable IOCs.
1 Document Findings
Hashes, file types, strings, header information.
2 Generate IOCs
IP addresses, domain names, URLs, filenames.
3 Prioritize IOCs
Based on severity and confidence level.
4 Share IOCs
With threat intelligence platforms and security tools.
Next Steps: Dynamic Analysis & Reverse
Engineering
Static analysis provides a foundation, but doesn't reveal runtime behavior.
1
2
Dynamic Analysis
Execute malware in a sandbox.
Reverse Engineering
Disassemble and decompile code.