Question

A malware analyst receives a suspicious executable recovered from an infected workstation. Before executing the sample, the analyst wants to safely extract metadata such as embedded strings, PE header details, imported API functions, and any packer signatures, without allowing the code to run. Which phase of the malware analysis process should the analyst perform FIRST, and why is it sequenced this way?

Accepted Answer

Static analysis, because examining the file's structure and artifacts without execution guides safer, more targeted dynamic analysis later

Answer

Dynamic analysis, because observing runtime behavior is required before any file structure can be interpreted

Answer

Memory forensics on the host, because volatile artifacts must be captured before the file can be inspected at all

Answer

Automated sandbox detonation, because it is the only method that can reveal imported API functions and packer signatures