39.4 Static vs Dynamic Analysis Mindset
Tumhi malware analyst nahi zhala tari mindset pahije:
Static (file shivay run):
- Hash:
SHA256– share IOC, search reputation - Strings / file type / signature – high level
- VirusTotal (and similar): upload only files you own / lab EICAR / samples your org legally allows – never upload confidential company docs (they become visible to VT community / vendors)
Dynamic (run to observe):
- Isolated sandbox VM / commercial sandbox
- Watch process tree, network (DNS/HTTP C2), file writes, registry Run keys
- Snapshot → run → observe → revert
Golden rule: NEVER run unknown malware on your host OS, never on office laptop, never with shared folders that map to real Documents. Samjla ka?
# Amazon Linux / lab helper – hash a file YOU created (EICAR text or marker script)
sha256sum eicar.com
# Ubuntu/Kali often: sha256sum; Windows: Get-FileHash .\eicar.com -Algorithm SHA256
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Packs / obfuscates to change hash daily | Behaviour EDR + sandbox detonation, not hash-only AV |
| Checks sandbox artifacts (short uptime, known VM MAC) | Multiple analysis layers; don't rely on one public sandbox alone |
| Hopes analyst uploads secret docs to public VT | Policy: no confidential uploads; private instance / internal sandbox |
Ravindra Bagale's Tip
Students random .exe VT var upload kartat – jar tyat customer data / keys asel tar leak. Hash sodun (local sha256sum) search kara aadhi; full file upload only when policy allows. Interview: static vs dynamic ek-ek line + "I never run samples on my host."
Lab
Official EICAR test string (from eicar.org documentation – text file you create yourself) lab VM madhe save kara as eicar.com. sha256sum note kara. Windows Defender / ClamAV scan – detect zala pahije. Screenshot. Host OS var skip. VirusTotal: only if your trainer/lab policy allows EICAR; never real docs.