title = "Malware Analysis Techniques"

content = """
Malware analysis produces actionable intelligence about adversary tooling, enabling
detection signature development, indicator extraction, and attribution support.
The unit employs three complementary analysis methods depending on time constraints
and the complexity of the sample.

**Static Analysis:** Examine the malware binary without executing it. Extract strings,
import tables, file metadata, and entropy measurements. Use disassemblers to review
code logic and identify obfuscation techniques. Static analysis is fast and carries
no execution risk but is limited against packed or heavily obfuscated samples.

**Dynamic Analysis:** Execute the sample in an isolated sandbox environment. Capture
system calls, network traffic, registry modifications, file system changes, and process
behavior. Sandboxes accelerate analysis of high-volume samples but may miss logic
triggered only under specific environmental conditions (sandbox evasion).

**Behavioral Analysis:** Combine dynamic observations with manual reverse engineering
to document the full kill chain — initial execution, persistence mechanisms, command-
and-control (C2) protocols, lateral movement routines, and payload delivery. This level
of analysis is reserved for high-priority samples tied to active incidents.

**Indicators of Compromise Extraction:** Produce a structured list of IOCs from each
analyzed sample: file hashes (MD5, SHA-256), IP addresses, domain names, URL patterns,
registry keys, mutex names, and YARA signatures. IOCs are ingested into the SIEM and
shared with partner organizations via the approved threat intelligence sharing platform.

**Safe Handling:** Malware samples are handled only in air-gapped or network-isolated
analysis environments. Samples may not be transferred to personal devices, unclassified
systems, or external cloud storage. Retention follows the unit's evidence retention policy.
"""

version = "0.0.1"
