Malware Analysis —
Know exactly what hit you.
When malware executes in your environment, you need more than a detection name. SignalPoint's GREM-certified analysts perform static and dynamic reverse engineering to understand exactly what the malware does, what it communicates with, and what it left behind — delivered in 48 hours.
A detection alert tells you something happened. Malware analysis tells you everything that happened.
When your EDR fires on a malicious file, the detection name — "Trojan.GenericKD" or "Ransom.Win32.Ryuk" — tells you the broad category. It does not tell you whether the malware established persistence, which systems it reached, what credentials it touched, what data it staged for exfiltration, or what command-and-control infrastructure it communicates with. That intelligence is what malware analysis produces.
SignalPoint's GREM-certified analysts perform both static analysis (examining the malware's code and structure without executing it) and dynamic analysis (executing the malware in an isolated environment and observing its behavior in real time). The combination produces a complete picture of capability and impact.
What our malware analysis report includes
- File metadata: hashes (MD5, SHA-1, SHA-256), compilation artifacts, packer identification
- Static analysis: strings extraction, import table analysis, obfuscation identification, code structure
- Dynamic analysis: process execution tree, file system modifications, registry changes, network traffic
- Command-and-control infrastructure: C2 domains, IP addresses, communication protocols and encryption
- Persistence mechanisms: scheduled tasks, registry run keys, service installation, bootkit components
- Credential access: password dumping modules, keylogger functionality, browser credential theft
- Lateral movement capability: network discovery, exploitation modules, worm propagation
- Data staging and exfiltration: file enumeration targets, archive creation, upload mechanisms
- Full IOC package: host-based and network-based indicators formatted for immediate deployment in your defensive tooling
- MITRE ATT&CK mapping: techniques and sub-techniques observed during analysis
Malware removal and remediation
Analysis produces the intelligence needed for complete remediation. Armed with the full list of persistence mechanisms, affected registry keys, scheduled tasks, and implanted files, our analysts can guide or perform a thorough removal — ensuring nothing is missed. Many organizations that rely on antivirus removal tools miss persistence mechanisms because those tools only remove what they can detect. Our analysis-driven approach finds and removes everything the malware installed.
Common samples we analyze
- Ransomware: pre-detonation samples and post-encryption forensic artifacts
- Remote access trojans (RATs) and backdoors
- Infostealers targeting browser credentials, cryptocurrency wallets, and corporate VPN tokens
- Loaders and droppers used in multi-stage attack chains
- Macro-enabled Office documents and weaponized PDFs
- PowerShell and script-based malware (fileless threats)
- Rootkits and bootkits
- Cobalt Strike and other commercial attack frameworks repurposed by criminal operators
When to request malware analysis
Request malware analysis whenever your EDR, AV, or email security quarantines a suspicious file; whenever you discover an unexplained process, scheduled task, or service on a system; or whenever an employee reports clicking a suspicious link or attachment. Analysis is also valuable as part of post-incident forensics — understanding the malware used in a breach is essential for confident eradication and for preventing reinfection.
Already experiencing a breach? If malware is actively running in your environment, incident response takes priority. We can coordinate malware analysis as part of the IR engagement — samples collected during forensics feed directly into our analysis pipeline.
Questions about malware analysis and removal.
Yes, but the transfer must be done securely. Contact us first and we will provide a secure, password-protected channel for sample submission. Never email malware samples as attachments — most email security gateways will strip or detonate them, and unprotected transmission risks accidental execution. We will walk you through proper sample handling and packaging.
Yes. Packing and encryption are the most common obfuscation techniques malware authors use to evade static detection. Our analysts are trained in unpacking techniques — both manual and automated — and can analyze the underlying payload regardless of the protection layer. Dynamic analysis also bypasses most packing schemes by capturing behavior after the malware unpacks itself in memory.
Yes. Our IOC package is delivered in multiple formats including STIX/TAXII, plain CSV, and tool-specific formats for common EDR and SIEM platforms. File hashes, network indicators, and host-based signatures are all included. We can also provide YARA rules for the specific malware family if warranted.