Static Malware Analysis DFE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A malware analyst is examining a suspicious executable. Detect It Easy reports that the file is packed with a custom packer, and the entropy of the .text section is 7.8. The analyst also notices that the file has an unusual number of sections and that the import table is minimal. The analyst must decide whether to attempt manual unpacking or use a different approach. What is the most appropriate next step?

   • AAttempt manual unpacking by analyzing the entry point and following the unpacking stub.
   • BUse a dynamic analysis sandbox to let the malware unpack itself and observe its behavior.
   • CSubmit the file to an online unpacking service and wait for the result.
   • DConclude that the file is benign because the high entropy indicates compression, not malware.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why does packing or obfuscation complicate static malware analysis?

   • AIt makes the file larger and harder to store
   • BIt changes the file's hash, making it impossible to identify
   • CIt prevents the file from being copied
   • DThe original code is not visible until the sample is executed
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What type of data can be found in the resource section (.rsrc) of a PE file?

   • AThe list of imported functions
   • BThe executable's digital signature
   • CThe executable's entry point
   • DIcons, version information, and custom embedded data
   Reveal Solution Discussion Select an answer first
5. 49application · easy

   A junior analyst is asked to perform static analysis on a suspicious file. The analyst wants to avoid executing the file. Which activity is consistent with static analysis?

   • AComputing the file's SHA-256 hash and comparing it to known malware hashes.
   • BRunning the file in a virtual machine to observe its behavior.
   • CDebugging the file to step through its instructions.
   • DMonitoring network traffic generated by the file.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A malware analyst is examining a suspicious executable and extracts strings. The strings include 'http://example.com/payload.bin', 'C:\Users\Public\file.exe', and 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run'. What is the most likely functionality of the malware?

   • AIt is a ransomware that encrypts files and displays a ransom note.
   • BIt is a keylogger that captures keystrokes and sends them to a server.
   • CIt is a benign utility that downloads updates and adds a startup entry.
   • DIt is a downloader that fetches a payload and establishes persistence.
   Reveal Solution Discussion Select an answer first