Malware analysis is the practice of examining malicious software to understand exactly what it does and how it works, and analysts rely on two genuinely different approaches to get there, static analysis, examining the code without ever executing it, and dynamic analysis, running it in a deliberately isolated environment and watching its actual behaviour. Each approach catches things the other one misses, which is exactly why serious malware analysis combines both rather than relying on either alone.
Static analysis is safe but can be actively resisted by the malware itself
Static analysis examines a piece of malware's code, disassembling or decompiling a compiled binary to reconstruct its underlying logic, without ever actually running it, which keeps the analyst's own systems completely safe from whatever the malware would otherwise do. Malware authors know this, and increasingly build in deliberate obfuscation, code specifically designed to resist being read and understood through static analysis alone, forcing analysts to fall back on watching the malware actually run instead.
Dynamic analysis watches real behaviour, but malware can detect it's being watched
Dynamic analysis runs the malware inside a deliberately isolated, sandboxed environment and observes what it actually does, which network connections it opens, what files it modifies, revealing real behaviour static analysis alone might miss or misread. Sophisticated malware increasingly checks for signs it's running inside such a sandbox rather than a real target system, and deliberately behaves differently, or does nothing at all, when it detects analysis is happening, forcing analysts into a continuing back-and-forth with malware authors over which side's current technique currently has the upper hand.
What we're still unsure about
That static and dynamic analysis each catch different things the other approach misses, and that combining both is standard analytical practice, is well established, uncontroversial malware analysis methodology. What's more genuinely unresolved is that this is a continuing arms race rather than a settled toolkit, malware authors keep developing new sandbox-detection and anti-debugging techniques specifically aimed at whatever analysis method currently works, and there is no complete, permanent way to guarantee a given piece of malware couldn't detect and evade the specific technique an analyst happens to be using against it right now.
This sits inside Malware Analysis & Reverse Engineering, one of seven topics in Cybersecurity, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.