## Introduction to Malware Analysis

Malware Analysis is the study of malicious software. Our goal is to understand:
1.  **Capability**: What can this malware do? (Steal passwords? Encrypt files?).
2.  **Indicators**: How can we detect it? (Files created, network traffic).
3.  **Attribution**: Who wrote it? (Rarely successful, but possible).

---

### Static Analysis (Safe & Fast)
Analyzing the file **without executing it**. It is like looking at a bomb through an X-ray machine.
*   **Pros**: Safe. Fast. Can analyze "dead" malware (C2 is offline).
*   **Cons**: Modern malware is "packed" (obfuscated) and hides its secrets until runtime.
*   **Techniques**:
    *   File Hashing (Fingerprinting).
    *   Strings Analysis (Finding text).
    *   PE Header Analysis (Import Table - what DLLs does it need?).

### Dynamic Analysis (Risky & Detailed)
**Running** the malware in a controlled environment (Sandbox) to watch it explode.
*   **Pros**: Shows true behavior. Unpacks itself automatically.
*   **Cons**: Risk of infection/escape. Some malware detects the sandbox and "plays dead" (Anti-VM techniques).
*   **Techniques**:
    *   Process Monitoring (ProcMon).
    *   Network Sniffing (Wireshark/Fiddler).
    *   Registry Watchers.

### The Golden Rule
**NEVER** analyze malware on your host machine.
**ALWAYS** use an isolated Virtual Machine (VM) with no shared folders and (preferably) a routed network interface that simulates the internet (like INetSim).