Measures for enabling resource-efficient remote malware scanning capable of static and dynamic file analysis including, at a remote entity, obtaining metadata of an electronic file to be scanned for malware, said metadata including at least information for identification of one or more file items contained in the electronic file, identifying whether at least one file item of the electronic file is not pre-known at the remote entity, instructing delivery of any identified at least one file item of the electronic file, reconstructing the electronic file by assembling its file items, including any file item of the electronic file, which is not pre-known at the remote entity, and any remaining file item of the electronic file, which is pre-known at the remote entity, on the basis of the obtained metadata of the electronic file, and executing a dynamic malware analysis on a runtime behavior of the reconstructed electronic file.