Name three stages of malware analysis at a high level and the objective of each.

• A. Static analysis examines binaries without executing.
• B. Dynamic analysis executes in a sandbox to observe behavior.
• C. Behavioral/over-time analysis monitors file, system, and network interactions to understand actions and persistence.
• D. All three stages are optional and equivalent.

Answer: (B)

Understanding malware analysis in three broad stages helps you see the full picture of what a sample can do. Static analysis looks at the code and assets without running them, gathering indicators from the binary itself. Dynamic analysis then jumps in by running the malware in a controlled sandbox to observe what happens in real time—what processes it spawns, files it creates or modifies, network calls it makes, and how it behaves during execution. Behavioral or over-time analysis takes this further by watching actions across longer periods and different system states to detect persistence methods and actions that only show up after some time.

The option describing dynamic analysis—executing in a sandbox to observe behavior—best captures the objective of that stage, since it centers on seeing runtime actions that static analysis cannot reveal. While static and behavioral analyses are also essential parts of a complete approach, they aren’t described by that single statement, and the idea that all three stages are optional or equivalent is incorrect.