The SOC team at a national cybersecurity agency detects anomalous network traffic from a sensitive...

Malware disassembly is the technique used to analyze a binary at the instruction level without executing it. It converts compiled machine code into assembly instructions so an analyst can study program logic, identify functions, locate strings and API calls, and understand how the malware performs actions such as persistence, command execution, credential theft, and exfiltration. This meets the requirement to avoid execution on a sensitive system, which is critical in high-risk environments where unintended detonation could cause further damage. Network behavior monitoring requires execution to observe outbound connections and protocols, which violates the “without executing” constraint. Dynamic code injection is an active technique used during runtime and is not appropriate when execution must be avoided. Interactive debugging often involves running the program under a debugger to observe behavior step-by-step; while it can be done in controlled labs, it still requires execution. For strict non-execution, disassembly is the correct static technique. SOC teams use disassembly results to produce detections (behavioral signatures, YARA-like patterns, API sequence indicators) and to identify IOCs such as domains, mutexes, registry keys, and file paths for enterprise-wide hunting.