What is static analysis intended to do when analyzing an executable file?

Static analysis involves examining a program without executing it. When applied to an executable file (binary code), a primary technique is disassembly. Disassembly translates the machine code into a human-readable assembly language representation. This allows an analyst to reverse-engineer the program's logic, identify its capabilities, search for vulnerabilities, and understand its overall function, such as determining if it is malicious. This process is fundamental to malware analysis and vulnerability research.

1. National Institute of Standards and Technology (NIST) Special Publication 800-83 Revision 1

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

November 2013. Section 3.3.2

"Analyzing Malware

" states

"Advanced static analysis involves reverse-engineering the malware’s code through use of a disassembler... The disassembler displays the executable’s code in assembly language

which the analyst can read and interpret to determine the malware’s functions."

2. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. Chapter 5

"Basic Static Analysis

" details the process. It explains that static analysis techniques include examining the file format

strings

and ultimately

using a disassembler to view the program instructions to understand its functionality without running the code.

3. Carnegie Mellon University

Software Engineering Institute (SEI). Introduction to Reverse Engineering Software. The courseware and materials frequently describe static analysis of binaries as a process centered on disassembly to understand the code's structure and function. For example

the CERT/CC blog post "The Basic Steps of the Reverse Engineering Process" (2018) identifies disassembly as a key step in static analysis.