What Static Analysis Gets You

• Fast triage: is this even malicious? What family?
• Indicators of Compromise (IOCs): domains, IPs, mutex names
• Capabilities from imports and API usage
• Detection content: YARA rules, hashes for sharing
• No risk of the sample calling home or trashing your host

The catch: static is only as good as your ability to read the code.