What is static executable file analysis?

Static executable file analysis is a fundamental technique in computer forensics and malware analysis. It involves examining an executable file to understand its structure, code, and potential functionality without running the program. This method is considered safe as the potentially malicious code is never executed. Analysts inspect elements like the file header, embedded strings, imported and exported functions, and the disassembled code to gather intelligence about the file's purpose and origin.

B. This describes dynamic analysis, which is the opposite of static analysis, as it requires the file to be launched to observe its behavior.
C. While static analysis is done "without launching," the phrase "in a controlled and monitored environment" is characteristic of dynamic analysis (sandboxing), making this option confusing and less accurate than A.
D. This is the precise definition of dynamic analysis, where a file is executed within a secure, isolated environment (a sandbox) to monitor its actions safely.

1. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. In Chapter 3, "Basic Static Analysis," the concept is introduced: "Basic static analysis consists of examining the executable file without viewing the actual instructions." (p. 41).

2. National Institute of Standards and Technology (NIST). (2005). Special Publication 800-83: Guide to Malware Incident Prevention and Handling. Section 3.3.2, "Analyzing Malware," states, "Static analysis is the process of analyzing a file without executing it." (p. 24).

3. Eilam, E. (2011). Reversing: Secrets of Reverse Engineering. Wiley. Chapter 1, "Foundations," distinguishes between the two primary analysis methods: "Static analysis... is based on analyzing code without actually executing it... Dynamic analysis is based on information gathered during program execution." (p. 18).