Summary

• Static = analyze without running; complete but defeated by packing/obfuscation.
• Fingerprint with hashes (exact + fuzzy + imphash) and file typing.
• Strings (ASCII + wide, FLOSS) and imports reveal IOCs and capabilities.
• Ghidra: decompiler + XREFs to confirm behavior.
• Detect packing via entropy / imports / sections (UPX).
• YARA and capa turn findings into scalable detection and ATT&CK mapping.