Because they had no tools and no lab to analyze within, I literally hashed them and compared the MD5 to reports online. Every malware analyst knows that this is NOT analysis, but short of building a lab with access to no VM's, having an isolated host, or wasting time by downloading static tools, this is all I could do.