# Malware Analysis Workflow
## Static Analysis
1. File metadata: `file`, `exiftool`, `ssdeep`
2. Strings: `strings -n 6`, FLOSS
3. PE/ELF headers: `readpe`, `readelf`
4. Imports/exports: API calls indicate capability
5. YARA rules: match against known signatures

## Dynamic Analysis
1. Sandbox: ANY.RUN, Cuckoo, CAPE, Joe Sandbox
2. Network: Wireshark, FakeNet-NG, INetSim
3. Process: Process Monitor, API Monitor, strace/ltrace
4. Registry/filesystem: monitor changes
5. Memory: Volatility 3 for memory forensics
