This guide is for learning. Run these commands only on your own lab or servers.
Malware analysis means studying a suspicious file to understand what it does so you can detect and defend against it. This guide is defensive. It uses the harmless EICAR test file, which antivirus tools detect on purpose, so nothing dangerous ever runs.
Legal note: only analyse files in an isolated lab on your own machine. Never run unknown files on your main computer, and never share or spread real malware.
1. Build an isolated lab
Use a virtual machine that has no personal data. Set its network to host-only or disconnected, turn off shared folders and clipboard sharing, and take a snapshot before you start so you can restore a clean state.
2. Identify the file without running it
file sample.bin
sha256sum sample.bin
strings -n 8 sample.bin | head -40The hash is the file's fingerprint. Search it on VirusTotal instead of uploading private files. The strings output can show names, messages and addresses that hint at the file's purpose.
3. Static analysis first
Look at file type, size and readable strings before anything else. Static analysis is safer because the file is never executed.
4. Record the indicators
Write down hashes, file names, strings and any addresses you find. These are indicators of compromise (IOCs) that other defenders can use to look for the same threat.
5. Write the report
A good report has a summary, the file details and hashes, what you did, your findings, the IOCs and a short recommendation. Keep it clear enough for someone who was not in the lab.
After the lab, restore the snapshot and delete the sample. Never keep unknown files on your main system.
