Without running the malware, students extract metadata, strings, and import/export tables to guess the program's functionality. They use tools to calculate hashes and identify packers.

Similar Lessons