Malware Analysis for Beginners: A Safe Lab Setup

Defensive guide. Analyse files only inside an isolated lab VM, and only files you are allowed to examine. This post does not cover creating or spreading malware.

Malware analysis means studying a suspicious file to learn what it does, so you can detect it and protect systems. A beginner can do real work with a safe lab and a clear method.

1. Build an isolated lab

Use a virtual machine that you can throw away. Before you start, take a snapshot, set the network to host-only or disconnected, turn off shared folders and clipboard sharing, and never run a sample on your main computer.

2. Static analysis: look without running

sha256sum sample.bin
file sample.bin
strings -n 8 sample.bin | head -50

The hash identifies the file. You can search the hash on VirusTotal instead of uploading the file, which is safer when the file may hold private data. Strings can show URLs, file names and messages.

3. Dynamic analysis: watch it in the VM

Run the sample only inside the isolated VM. Watch which processes start, which files and registry keys change, and which network connections it tries. Tools such as Process Monitor and Wireshark help. Afterwards, restore the snapshot.

4. Memory and disk evidence

Autopsy helps with disk images and Volatility helps with RAM captures. Together they show hidden processes and leftover files, as in my forensic investigation project.

5. Collect indicators

Indicators of compromise are the clues defenders can search for: file hashes, domains and IP addresses, file paths, registry keys and process names.

6. Write the report

Summary: what the file is and how risky it is
Sample: name, size, SHA-256
Behaviour: what it did in the lab
Indicators: hashes, domains, paths, keys
Recommendations: how to detect and remove it

For practice, start with harmless test files such as the EICAR antivirus test file, then move to documented samples from trusted training sources.