Inspect a suspicious file safely, without running it
A file lands in your downloads or your inbox and you do not trust it. The dangerous instinct is to double-click it to 'see what it is'. The professional move is the opposite: examine it from the outside, without ever letting it run, and decide whether it is dangerous before it gets the chance to do anything. That is static analysis. In this mission you learn to read an unknown file the way an analyst does: its true type, its hash, the text and web addresses hidden inside it, its metadata, and anything a second file is hiding inside it, then look its hash up against the world's antivirus engines. You practise on the EICAR antivirus test file (a harmless standard that every scanner recognises) and on sample files you build yourself, never on real malware and never on anyone else's private files. It pairs with Build a hacking lab, which sets the one rule everything here obeys.
- A Linux command line. On Windows that means WSL2 (Windows Subsystem for Linux) running Ubuntu; open PowerShell and run
wslto enter it. On macOS or Linux your normal terminal is fine. If the command line is new to you, the Level 0 lesson [Install anything from GitHub](/learn/install-anything-from-github) covers the basics first - Six small command-line tools. Most are already present (
file,sha256sum,md5sum,strings,xxd); two usually are not (exiftoolandbinwalk). On Ubuntu or WSL2 install both withsudo apt install libimage-exiftool-perl binwalk; on macOS usebrew install exiftool binwalk - The lab-only mindset from [Build a hacking lab](/learn/build-a-hacking-lab): you examine files on your own machine, for your own understanding, never anyone else's private files
- When you later need to actually run a file to watch what it does, the follow-on lesson [Run untrusted code safely in a sandbox](/learn/sandbox-untrusted-code-safely). Static analysis is step one; a sealed sandbox is step two, and this mission stops before anything is executed
The one rule: look, do not run
Fix the single safety habit this whole lesson is built on before you touch a file, and understand why looking beats running.
A suspicious file does nothing until something opens it. A document is inert until a reader parses it; a script is inert until an interpreter runs it; a program is inert until you launch it. Static analysis means examining the file as data, from the outside, without ever giving it that chance. You read its bytes, its text and its structure. You never execute it. Everything in this mission is read-only, and that is the whole point.
The opposite approach, running the file to 'see what it does', is called dynamic analysis, and it is genuinely useful, but only inside a sealed, disposable sandbox built for it. On your real machine, double-clicking an unknown file is how people get compromised. Static analysis is safe to do anywhere because nothing runs, and it answers most of your questions before you ever need to consider running anything. That is why it comes first: it is free of risk and it is usually enough.
You will practise on the EICAR test file. This is a 68-byte string, agreed on by the antivirus industry, that every scanner is built to detect as if it were a virus, even though it does nothing at all. It exists precisely so people can test tools and learn safely without going near real malware. It is the only 'malware' this mission uses, and it cannot harm anything.
The one rule, the same one the whole track obeys: you examine files on your own machine, for your own understanding, never anyone else's private files, and you never run a file you are investigating outside a sandbox. Looking at a file is always lawful. Running an unknown file on a machine or network you do not own, or uploading someone else's private file to a public service, is where trouble starts.
CarefulNever double-click or open a file you are investigating to find out what it is. That is the one action static analysis exists to avoid. If you genuinely need to watch a file behave, do it in a sealed sandbox (the follow-on lesson), never on your real machine.TipKeep everything in one throwaway folder. If a file ever turns out to be real malware, a single folder is simple to delete, and because you never ran anything, deleting it is the end of the story.