Analyzing Malware: A Comparative Study of Static and Dynamic Methods through Reverse Engineering

Abstract

Malware remains a critical and evolving threat to modern computing environments, necessitating advanced defensive strategies from cybersecurity professionals. This study explores malware analysis through both static and dynamic approaches within a Windows-based environment, emphasizing the role of reverse engineering. Static analysis involves inspecting malware binaries, structure, and metadata without execution. Tools such as IDA Pro and CFF Explorer allow analysts to uncover embedded exploits, operational logic, and potential payloads, offering deep structural insight into the malware’s functionality.In contrast, dynamic analysis focuses on observing malware behaviour in real time by executing it within an isolated virtual machine. This method, supported by tools like Process Monitor (ProcMon), enables analysts to track runtime activities, such as API calls, file system alterations, registry modifications, and network interactions. The integration of these tools provides a comprehensive view of malware behaviour, both at the static and operational levels.The paper also highlights the growing sophistication of malware, which increasingly employs obfuscation and evasion techniques. Thus, combining static and dynamic analyses— augmented by antivirus tools and SIEM platforms like Wazuh—enhances detection capabilities. The study concludes that a hybrid reverse engineering strategy significantly strengthens malware defence, offering actionable recommendations to reduce future threats within enterprise-level Windows environments. Keyword—Malware,Reverse Engineering, Static analysis, Dynamic Analysis