## Static vs. Dynamic Analysis: Two Roads to Truth

When you find a suspicious file (`invoice.exe`), you have two ways to analyze it.

### 1. Static Analysis (The "Autopsy")
Examining the file **without running it**.
It is safe, fast, but can be defeated by obfuscation.

*   **What we look for**:
    *   **Hashes**: MD5/SHA256. Is this file known to VirusTotal?
    *   **Strings**: ASCII/Unicode text inside the binary.
        *   Bad: `cmd.exe`, `Powershell -enc`, `http://evil.com/payload`.
        *   Good: `Copyright Microsoft Corporation`.
    *   **Imports (PE Headers)**: What Windows functions does this program use?
        *   `InternetOpenUrl`: Connects to internet.
        *   `GetKeyState`: Logs keystrokes?
        *   `CryptEncrypt`: Ransomware?
    *   **Packers**: Is the code compressed/obsfuscated (UPX)?

### 2. Dynamic Analysis (The "Sandbox")
Running the file in a controlled, isolated environment to see **what it does**.
It is dangerous (if it escapes) but shows the true behavior.

*   **What we look for**:
    *   **Process Activity**: Did it spawn `cmd.exe`?
    *   **File System**: Did it drop a file in `C:Temp`?
    *   **Registry**: Did it add a Run key for persistence?
    *   **Network**: Did it DNS query `attacker.com`?

### The Hybrid Workflow
Always start with Static.
1.  **Hash it**: Use `sha256sum`. Check VirusTotal. If it's known bad, you are done.
2.  **Strings it**: Use `strings`. Look for IPs/URLs.
3.  **PE Analysis**: Use `PEStudio`. Check imports.
4.  **Sandbox it**: If Static is inconclusive, move to Dynamic. Run it in a VM (Cuckoo/Any.Run) and watch the fireworks.

### Evasion Techniques
*   **Anti-Static**:
    *   **Packing**: Compressing the code so "Strings" returns garbage. The code only unpacks in memory when run.
    *   **Obfuscation**: Changing variable names (`var a = 1`) to nonsense (`var x8z9 = 1`).
*   **Anti-Dynamic**:
    *   **Sleep**: "Wait 1 hour before doing anything." (Sandboxes usually only run for 5 minutes).
    *   **User Check**: " Check if the mouse is moving. If not, I am in a sandbox. Do nothing."
    *   **VM Check**: "Check hardware ID. If it says 'VMware Virtual Disk', do nothing."