Describe the difference between static and dynamic malware analysis.

• A. Dynamic analysis runs malware in a controlled environment to observe behavior.
• B. Static analysis examines code without executing.
• C. Static analysis runs the sample to observe behavior.
• D. Dynamic analysis disassembles code.

Answer: (B)

The main idea is that static analysis looks at the code without running it, while dynamic analysis runs the malware in a controlled environment to see what it does. Static analysis involves inspecting the binary or source, reading decompiled code, examining strings, metadata, and the control flow to infer potential behavior without executing anything. This approach is safer and faster and can reveal indicators like hard-coded URLs, IPs, or suspicious API names, but it may miss actions that only occur when the code is actually executed or when it unpacks itself.

Dynamic analysis, by contrast, executes the sample in a sandbox and monitors real-time activity: which files are created or modified, registry changes, processes that start, network connections, and the sequence of API calls. This exposes actual runtime behavior, including unpacked payloads and conditional logic that static analysis might not reveal. However, it requires a carefully isolated environment to prevent damage and can be evaded by anti-analysis tricks.

So, the statement that static analysis examines code without executing captures the essential difference and why static and dynamic analyses complement each other in malware investigations.