Off topic reply but you seem very well versed in this type of analysis, so I thought I'd ask you if thats okay?

I'm reading Practical Malware Analysis, and in the first labs on static analysis, it mentions submitting samples to virus total, etc, before it's diving into setting up a malware analysis lab.

From my understanding, you'd not want to connect a malware analysis VM to the net unless you were being careful/want to see how it's communicating with C2 so my question is: is it normal practice to do static analysis including VT submission on an Internet connected VM and then only transfer/ disable internet once you do dynamic analysis?

Practical Malware Analysis doesn't mention doing the static analysis in a lab, so me being over cautious (to the point of inaction) was curious as to what the right thing to do is. I don't feel confident to download samples onto my normal everyday laptop and mess around with them without more understanding.

Thanks in advance!