Machine learning-based malware detection addresses a central limitation of signaturedriven security: malicious programs can alter their syntax, packaging, and execution traces faster than manually authored rules can be updated. This review examines how static and dynamic analysis generate complementary evidence for binary detection, family classification, variant recognition, and first-time-appeared malware detection. Static analysis extracts information without executing a file, including metadata, imported functions, byte patterns, opcodes, and assembly-derived representations. Dynamic analysis observes execution in an isolated environment through API calls, system calls, runtime opcodes, and other behavioral traces. Static methods offer low latency and high throughput, whereas dynamic methods can expose behavior concealed by packing and code obfuscation, although they require controlled execution and cannot observe behavior that the sandbox fails to trigger. The literature increasingly evaluates hybrid analysis, which combines code-level and behavioral evidence rather than treating the two views as independent alternatives. Integrated static and dynamic features improved reported accuracy over either individual view in several studies, while correlated fusion of static and dynamic API sequences produced detection and classification accuracies of 97.89% and 94.39%, respectively, in MalDAE. Classical machine learning remains useful where features are compact, interpretable, and computationally constrained. Deep learning reduces manual feature design by learning representations from bytes, images, opcode sequences, API traces, and heterogeneous feature spaces, but reported performance is highly sensitive to dataset construction and temporal separation. The synthesis therefore treats accuracy as one dimension of detector quality. Computational cost, execution coverage, family and platform scope, zero-day evaluation, explainability, adversarial robustness, and resistance to concept drift are equally relevant to deployment. Chronologically organized benchmarks show that malware families, packers, and evolved samples induce distinct forms of distribution change, while adversarial studies demonstrate that evasion, poisoning, and backdoors can invalidate apparently strong classifiers. The review compares these evidence sources and learning strategies to identify when feature fusion, adaptive updating, and explicit robustness testing are justified.