Malware Analysis
Determining exactly what a piece of malware does, how it got in, and how far it actually spread.
Who this is for: Businesses that found malware during an incident and need to know precisely what it did, not just that it was there.
The Problem
“We found and removed the malware” doesn’t answer the questions that actually matter: what did it access, did it exfiltrate anything, and is there a second piece still hiding somewhere.
Our Solution
We analyze the malware itself, in a controlled environment, to determine its actual capability and behavior, then trace that against your systems to scope the real impact.
What's included
- Static and dynamic malware analysis
- Behavioral analysis in a controlled (sandboxed) environment
- Capability assessment (what the malware could actually do)
- Indicators of compromise (IOC) extraction for wider scanning
- Impact scoping against affected systems
This is typically part of a broader Incident Response or Digital Forensics engagement, our ClickFix malware case study is a real example of exactly this kind of analysis being necessary to close a case properly instead of just deleting the visible file.
Benefits
- A precise understanding of what the malware actually did
- Indicators of compromise that let us scan for it elsewhere in your environment
- Confidence that closing the case means it’s actually closed
Our Process
Isolate
Contain the sample in a controlled environment.
Static Analysis
Examine the malware without executing it.
Dynamic Analysis
Observe behavior in a sandboxed environment.
Extract IOCs
Identify indicators to scan for elsewhere.
Report
Document capability and scope of impact.
Proven results: See a real example of malware analysis in our ClickFix WordPress clean-up case study. See the write-up →
Frequently asked questions
Is this always part of an incident response engagement?
Usually, yes, malware analysis is most valuable in the context of understanding a specific incident’s scope, though it can be scoped as a standalone service if you already have a sample to analyze.
How long does malware analysis take?
It depends heavily on the malware’s sophistication, from a few hours for a simple, known family to several days for something custom or highly obfuscated.
Related services
Incident Response
24/7 breach containment, forensic timeline, and recovery when every minute counts.
fingerprintDigital Forensics
Reconstructing exactly what happened, with evidence handling that holds up for insurers, regulators, and legal proceedings.
gpp_badRansomware Response
Containment, a fact-based pay-or-restore decision, and recovery, for a ransomware incident happening right now.
Not sure if this is the right fit?
Tell us what's worrying you. We'll tell you what actually needs fixing first.