During dynamic analysis, an analyst observes that the malware makes DNS queries to a domain that changes with each execution. The analyst suspects the malware is using a domain generation algorithm (DGA). The analyst has captured network traffic with Wireshark. Which additional step would best confirm DGA usage?

Run the malware multiple times and compare the DNS queries to see if the domain names follow a predictable pattern.

Check the malware's file hash against a DGA database.

Analyze the DNS queries for a high volume of NXDOMAIN responses.

Look for a single hardcoded domain in the malware's strings.

An analyst has completed dynamic analysis of a downloader that fetches a second-stage payload. The analyst captured network traffic and observed the download. The analyst must write a report that includes the URL of the second-stage payload. Which information from the Wireshark capture should the analyst use to extract the URL?

The TCP handshake packets that establish the connection.

The DNS query that resolved the domain name.

The TLS certificate presented by the server.

The HTTP request line and the Host header in the packet that contains the GET request.

Which section should be included in a structured dynamic malware analysis report?

A list of all websites visited by the analyst during the analysis

The analyst's personal recommendations for purchasing security software

The exact time the analyst took a coffee break

Behavioral observations, such as files created and processes spawned

A security analyst is tasked with analyzing a sample that is known to be time-bombed: it will only execute its malicious payload after a specific date. The analyst has a limited time window to complete the analysis. Which approach would allow the analyst to observe the malicious behavior without waiting for the trigger date?

Run the sample in a sandbox that automatically fast-forwards the system time.

Wait until the trigger date and then execute the sample.

Use static analysis to identify the trigger condition and bypass it.

Change the system clock in the VM to the trigger date before executing the sample.

EC-CouncilDigital Forensics Essentials

Domain 7Objective 4

Dynamic Malware Analysis DFE Practice Questions (Page 8)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 36–40

36expert · hard
During dynamic analysis, an analyst observes that the malware makes DNS queries to a domain that changes with each execution. The analyst suspects the malware is using a domain generation algorithm (DGA). The analyst has captured network traffic with Wireshark. Which additional step would best confirm DGA usage?
Select an answer first
37expert · medium
An analyst has completed dynamic analysis of a downloader that fetches a second-stage payload. The analyst captured network traffic and observed the download. The analyst must write a report that includes the URL of the second-stage payload. Which information from the Wireshark capture should the analyst use to extract the URL?
Select an answer first
38foundation · easy
Which section should be included in a structured dynamic malware analysis report?
Select an answer first
39expert · medium
A security analyst is tasked with analyzing a sample that is known to be time-bombed: it will only execute its malicious payload after a specific date. The analyst has a limited time window to complete the analysis. Which approach would allow the analyst to observe the malicious behavior without waiting for the trigger date?
Select an answer first
40application · medium
An analyst is monitoring a malware sample that is suspected of injecting code into other processes. Which tool would best allow the analyst to observe the process hierarchy and identify which processes are spawned by the malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Dynamic Malware Analysis DFE Practice Questions (Page 8)

Questions 36–40

Which section should be included in a structured dynamic malware analysis report?

An analyst is monitoring a malware sample that is suspected of injecting code into other processes. Which tool would best allow the analyst to observe the process hierarchy and identify which processes are spawned by the malware?

Keep studying — Malware Forensics