Hybrid Analysis

What it does

Executes suspicious files in a sandbox environment and provides detailed behavioral analysis. Uses CrowdStrike Falcon for static analysis, reputation lookups, and AV engine scanning.

When to use it

• Analyzing suspicious executables
• Understanding malware behavior
• When you need full execution analysis

When not to use it

• Quick code inspection
• Simple deobfuscation tasks
• When you just need to read the code

Limitations

• Analysis takes time
• Requires file upload
• May not trigger all malware behaviors