Workflow Stages in Detail

• Triage: hashes, file type, packer detection, VirusTotal / prior intel. Is this worth deep analysis? Get quick wins.
• Static analysis: examine without running — strings, PE headers, imports, embedded resources, disassembly overview.
• Dynamic analysis: run in a sandbox and watch — files, registry, processes, network. Fast behavioral picture.
• Reverse engineering: read the disassembly / decompilation to understand specific logic (crypto, C2 protocol, anti-analysis).
• Reporting + IOCs: write it up; produce hashes, domains, YARA rules, and behavioral signatures others can act on.