3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are analyzing a malware sample in a sandbox. The sample appears to sleep for a long time and then exits without performing any observable malicious activity. You suspect it is evading analysis. What should you do next?

   • AImmediately perform static analysis to identify the evasion technique.
   • BRun the sample on a physical machine without any monitoring.
   • CConclude that the sample is benign and close the investigation.
   • DIncrease the sandbox timeout and enable network simulation to encourage the malware to proceed.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A malware analyst has completed a detailed analysis of a banking trojan, including static and dynamic analysis. The analyst must share the findings with the bank's security team, law enforcement, and a threat intelligence sharing platform. The bank's security team needs actionable IOCs, law enforcement needs a legal summary, and the sharing platform needs a structured report. What is the best approach?

   • AVerbally brief the security team and email a short summary to law enforcement and the sharing platform.
   • BPost the full report on the company's internal wiki and provide a link to all parties.
   • CCreate three separate reports: a technical IOC report for the security team, a non-technical summary for law enforcement, and a STIX/TAXII-formatted report for the sharing platform.
   • DCreate a single comprehensive report and send it to all parties.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are analyzing a network capture and notice a series of HTTP POST requests to a suspicious domain, each with a small payload. You suspect data exfiltration. What should you do to confirm and extract the exfiltrated data?

   • AFollow the TCP streams and reassemble the POST payloads to see the data being sent.
   • BUse the strings command on the packet capture to find the data.
   • CRun the packet capture through a sandbox to execute any embedded malware.
   • DBlock the suspicious domain at the firewall and move on.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are analyzing a worm that spreads via SMB. In your sandbox, you want to observe its propagation behavior without allowing it to escape. Which configuration is most appropriate?

   • AConnect the sandbox to the production network to observe real propagation.
   • BUse a virtual network with simulated SMB services and monitor all traffic.
   • CDisable the network adapter in the sandbox to prevent any spread.
   • DRun the sandbox on a host with shared folders to attract the worm.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You have a suspicious Windows executable that you must analyze without executing it. You need to quickly determine whether it is packed and identify any embedded URLs or IP addresses. Which two techniques should you combine?

   • ASubmit the file to an online multi-scanner and review the detection names.
   • BInspect the PE headers and section names, then run the strings utility.
   • CDisassemble the binary with a debugger and set breakpoints on API calls.
   • DRun the executable in a sandbox and observe network connections.
   Reveal Solution Discussion Select an answer first