Malware analysis (deep RE)

When it applies

defense-malware-triage gave a verdict and you need the deep dive: a packed or obfuscated sample, a family you must write durable detection for, or an implant recovered on an engagement whose C2, injection, and persistence mechanisms you need to document. Covers EXE / DLL / SYS / .NET and script droppers (bat, ps1, vba). Always work inside an isolated analysis VM — detonating an unknown sample on a real host is itself an incident.

Why it works

Malware hides its intent behind packing, dynamic API resolution, and environment checks, but every layer must eventually resolve to real API calls and real behavior. Static analysis maps the capabilities; a debugger or sandbox catches what only exists at runtime (decrypted strings, resolved imports, injected code). Detection written on code/string internals — not hashes — survives recompilation.

Method

Anti-analysis catalog, YARA/Sigma writing guide, and rule examples: see cheatsheet.md next to this file.