3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A malware sample behaves differently in your sandbox than in the victim environment. You suspect it is using environment-specific triggers. You need to confirm this and understand the trigger. Which approach is most effective?

   • APerform static analysis to find all conditional branches and manually evaluate each.
   • BCompare the sandbox environment to the victim's environment and adjust the sandbox to match likely triggers.
   • CRun the sample multiple times in the same sandbox to see if behavior changes.
   • DConclude that the sample is polymorphic and cannot be analyzed.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During static analysis of a suspicious PDF file, an analyst extracts a JavaScript object that appears to exploit a known vulnerability. The analyst wants to understand the exploit's behavior without opening the PDF in a vulnerable reader. Which technique should the analyst use?

   • AUse a hex editor to search for the string 'JavaScript' in the PDF.
   • BRun the PDF in a sandbox with a vulnerable reader to observe the exploitation.
   • COpen the PDF in a patched reader and enable JavaScript to observe the exploit.
   • DDeobfuscate the JavaScript and manually trace its logic to identify the exploit payload.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   Dynamic analysis of a malware sample shows it creates a mutex, writes to a specific registry key, and then exits. You suspect it is a dropper that installs a second stage, but no second stage is observed. What is the most likely reason, and what should you do next?

   • AThe sample is benign and the registry write is a false positive.
   • BThe sandbox blocked the second stage download; you should allow all network traffic in the sandbox.
   • CThe second stage is stored in the registry and will be executed later; you should check the registry value and extract it.
   • DThe sample is a dropper that requires a specific command-line argument to drop the second stage; you should try different arguments.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which tool is commonly used for reverse engineering and disassembling malware binaries on the x86/x64 architecture?

   • ASysinternals Process Monitor
   • BNmap
   • CWireshark
   • DIDA Pro
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   You are analyzing a malicious document that downloads a payload from a URL. You have extracted the URL from the document's macros. What is the next step in the malware analysis process?

   • ASearch the URL in a threat intelligence platform to identify the malware family.
   • BImmediately execute the document in a sandbox to observe the download.
   • CUse a tool to download the payload from the URL in a controlled environment and then analyze it.
   • DBlock the URL at the firewall and close the case.
   Reveal Solution Discussion Select an answer first