Static vs Dynamic Analysis
What is it?
Static analysis examines the sample WITHOUT running it (structure, strings, imports); dynamic analysis observes the sample WHILE it runs in isolation (processes, files, network). Static is safe and fast but defeated by packing/obfuscation; dynamic reveals real behavior but can be defeated by evasion. They are complementary, not rivals.
Why it matters
Choosing the right approach for the question saves hours and avoids wrong conclusions — 'nothing in the strings' is not 'nothing dangerous' if the sample is packed.
Where you see it
Every analysis: static first (safe, fast), dynamic where static hits a wall (packing) or where behavior must be confirmed.
What normal looks like
Not applicable directly.
What suspicious looks like
A sample that is nearly empty of strings and imports (a static dead end) — a strong hint it is packed, and a signal to go dynamic.
How analysts investigate
By starting static (cheap, safe), and pivoting to dynamic when static is blocked or when a behavioral claim needs proof.
Common beginner mistakes
- Concluding a packed sample is benign because static analysis found little — emptiness under packing is a red flag, not an all-clear.
Badr's sample yields almost nothing on static inspection: a handful of strings, three imports, high entropy throughout. To a beginner that reads as 'boring'. To an analyst it screams 'packed' — the real code is compressed and only unpacks in memory at runtime. The static dead end is itself the finding that sends this one to the sandbox.
Quick check
Static analysis of a sample finds only a few strings, few imports and uniformly high entropy. What is the right read?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.