Static analysis reads a file’s code and structure without running it, which catches obviously malicious code but misses anything that only reveals itself at runtime. Dynamic analysis runs the file inside an isolated environment and records what it actually does: registry edits, spawned processes, dropped files, and any malicious traffic reaching out to a remote address. Malware built with packing, obfuscation, or delayed execution is specifically designed to pass a static check and only show its real behavior once it’s running, which is exactly what dynamic analysis is built to catch.
