Not every analyst can reverse-engineer a binary, and on a live investigation you rarely have the time anyway. That's not a reason to walk away from the sample.
Detonate it in a sandbox and its behavior gives you intelligence on its own. What it reaches out to. The infrastructure it phones home to. The tooling and campaign connections written all over its behavioral output. You can pull actor infrastructure and campaign links from how a sample acts, without ever opening a disassembler.
It's a fast, practical skill that most CTI training skips entirely — too technical for the beginner courses, assumed away by the advanced ones.
Dark Web Advanced CTI covers it directly: extracting infrastructure and attribution from behavioral output alone, then connecting it into the broader picture — C2 servers, phishing domains, bulletproof hosting, redirectors. 65+ C2 detection methods, taught hands-on. Real capability, no automation, nothing you're renting from a vendor. 120 days of access, exam and certificate.
https://epcyber.com/dark-web-cti-advanced.html