39.4 Static vs Dynamic Analysis Mindset
Tumhi malware analyst nahi zhala tari mindset pahije:
Static (file shivay run):
- Hash:
SHA256– share IOC, search reputation - Strings / file type / signature – high level
- VirusTotal (and similar): upload only files you own / lab EICAR / samples your org legally allows – never upload confidential company docs (they become visible to VT community / vendors)
Dynamic (run to observe):
- Isolated sandbox VM / commercial sandbox
- Watch process tree, network (DNS/HTTP C2), file writes, registry Run keys
- Snapshot → run → observe → revert
Golden rule: NEVER run unknown malware on your host OS, never on office laptop, never with shared folders that map to real Documents. Samjla ka?
# Amazon Linux / lab helper – hash a file YOU created (EICAR text or marker script)
sha256sum eicar.com
# Ubuntu/Kali often: sha256sum; Windows: Get-FileHash .\eicar.com -Algorithm SHA256
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Packs / obfuscates to change hash daily | Behaviour EDR + sandbox detonation, not hash-only AV |
| Checks sandbox artifacts (short uptime, known VM MAC) | Multiple analysis layers; don't rely on one public sandbox alone |
| Hopes analyst uploads secret docs to public VT | Policy: no confidential uploads; private instance / internal sandbox |
Ravindra Bagale's Tip
Students upload a random .exe to VT – if it contains customer data or keys, that's a leak. Search by hash first (local sha256sum); upload the full file only when policy allows. Interview: one line each on static vs dynamic + "I never run samples on my host."
Ravindra Bagale's Tip – मराठी
Students random .exe VT वर upload करतात – त्यात customer data / keys असतील तर leak. आधी hash ने (local sha256sum) search करा; full file upload फक्त policy परवानगी देत असेल तेव्हा. Interview: static vs dynamic एक-एक line + "I never run samples on my host."
Ravindra Bagale's Tip – हिंदी
Students random .exe VT पर upload कर देते हैं – उसमें customer data / keys हों तो leak. पहले hash से (local sha256sum) search करो; full file upload सिर्फ़ तब जब policy इजाज़त दे. Interview: static vs dynamic एक-एक line + "I never run samples on my host."
Lab
Official EICAR test string (from eicar.org documentation – text file you create yourself) lab VM madhe save kara as eicar.com. sha256sum note kara. Windows Defender / ClamAV scan – detect zala pahije. Screenshot. Host OS var skip. VirusTotal: only if your trainer/lab policy allows EICAR; never real docs.