Why should analysts use more than one malware analysis tool or method?

### What a good answer covers - Different tools reveal different evidence, such as strings, registry changes, network activity, or code instructions. - Scanners can be fooled by changed malware signatures. - Basic static and dynamic methods can each miss behaviour. - Analysts should choose tools that fit the question and use a safe, authorized environment. ### The concept Malware analysis is an iterative process rather than a search for one perfect tool. A file hash can identify a sample, but not describe its behaviour; a dynamic test can reveal behaviour, but may not trigger every capability. Combining evidence helps avoid relying on one incomplete result. ### Terms - **Signature**: A recognizable pattern used by a scanner to identify known malware. - **Static analysis**: Examination without executing the program. - **Dynamic analysis**: Examination by running the program and monitoring it. ### Remember Use multiple methods because each method has blind spots.