3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is part of static malware analysis?

   • AMonitoring registry changes during execution
   • BRunning the binary in a debugger to observe its behavior
   • CCapturing network traffic from the malware
   • DExamining the binary's strings and file structure without executing it
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   You have finished analyzing a downloader that fetches a second-stage payload. Your report needs to help the detection engineering team create signatures. Which information is most important to include?

   • AThe full static and dynamic analysis logs, including every API call.
   • BThe malware's SHA-256 hash, the C2 URL pattern, and the HTTP request headers it sends.
   • CThe malware author's likely motivation and threat actor group.
   • DThe list of files encrypted by the malware during sandbox execution.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A malware sample you are analyzing in a standard sandbox never executes its payload. Static analysis reveals anti-VM instructions and a long sleep call. You need to obtain a behavioral profile. Which approach is most effective?

   • AAbandon dynamic analysis and rely solely on static reverse engineering.
   • BRun the sample again in the same sandbox with a longer timeout.
   • CUse a bare-metal dynamic analysis system that is harder for the malware to detect.
   • DPatch the anti-VM instructions in the binary and then run it in the sandbox.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which element is typically included in a structured malware analysis report?

   • AThe complete source code of the malware
   • BIndicators of compromise (IOCs) such as file hashes and network domains
   • CThe analyst's personal opinion about the malware's origin
   • DA list of all network packets captured during analysis
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After dynamic analysis of a ransomware sample, you have a list of files it encrypted and the C2 domains it contacted. However, you still do not know the encryption algorithm or where the decryption key is stored. Which next step is most appropriate?

   • ARun the sample again in the sandbox with different command-line arguments.
   • BSearch the internet for the malware family's source code.
   • CPerform static analysis on the binary to identify cryptographic imports and key storage routines.
   • DConclude that the encryption algorithm is AES because it is the most common.
   Reveal Solution Discussion Select an answer first