Static Malware Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is performing static analysis on a malware sample that uses anti-disassembly techniques and is packed with a custom packer. The analyst has spent significant time trying to unpack the sample but has been unsuccessful. The analyst needs to provide a preliminary assessment to the incident response team. Which approach is most appropriate?

   • AStop analysis and report that the sample cannot be analyzed.
   • BRecommend dynamic analysis in a sandbox to observe the malware's behavior.
   • CConclude that the malware is benign because static analysis did not reveal malicious indicators.
   • DSubmit the sample to VirusTotal and use the detection ratio as the final assessment.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What type of information can string extraction reveal from a malware binary?

   • AThe malware's network packets
   • BThe malware's runtime memory contents
   • CURLs, IP addresses, and file paths
   • DThe malware's encryption keys
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key limitation of static malware analysis?

   • AIt cannot reveal the behavior of packed or obfuscated code
   • BIt always requires an internet connection
   • CIt is only useful for Linux malware
   • DIt cannot identify file hashes
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why might an analyst examine the version information embedded in a malware sample's resources?

   • ATo determine the malware's network protocol
   • BTo find clues about the malware's origin or authorship
   • CTo calculate the malware's hash
   • DTo identify the malware's entry point
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst extracts strings from a packed malware sample and finds a URL that appears to be a C2 endpoint. However, the analyst knows the sample is packed. What is the most appropriate conclusion?

   • AThe URL is irrelevant because static analysis cannot be trusted for packed malware.
   • BThe URL is definitely the C2 server because it was found in the binary.
   • CThe URL is definitely a decoy because the sample is packed.
   • DThe URL may be part of the unpacking stub or a decoy; it should be verified after unpacking.
   Reveal Solution Discussion Select an answer first