An analyst is examining the resources of a suspicious executable and finds a custom resource type named 'DATA' that contains a large binary blob. What is the most appropriate action?

Extract the blob and analyze it separately, as it may contain a hidden payload.

Ignore the blob because custom resources are rarely used by malware.

Run the executable to see what the blob does.

Delete the blob to prevent the malware from using it.

During static analysis of a suspicious executable, you extract the version information resource and find the company name 'Microsoft Corporation' and the product name 'Windows Update'. However, the file's digital signature is invalid. What is the most likely explanation?

The file is safe because the version info matches a known Microsoft product.

The file is a driver that requires a special signature validation process.

The file is a legitimate Microsoft binary that was corrupted during download.

The version information was likely spoofed to make the file appear legitimate.

A malware analyst is examining a suspicious executable and extracts a resource that contains a string that looks like a base64-encoded blob. The analyst decodes it and finds a URL. However, the URL is not present in the binary's strings. What is the most likely reason?

The URL is hidden in the resource to evade string-based detection.

The URL is a false positive from the decoder.

The URL is a decoy and has no relevance to the malware.

The URL is generated dynamically and has no static representation.

What is the purpose of the PE header in a Windows executable?

It contains the executable's digital signature

It provides the operating system with information needed to load and run the executable

It lists all the system calls the program will make

It stores the malware's configuration data

What is the primary characteristic of static malware analysis?

Observing system calls made by the malware during execution

Monitoring network traffic generated by the malware

Running the malware in a controlled environment to observe its behavior

Examining the malware's code and structure without executing it

EC-CouncilDigital Forensics Essentials

Domain 7Objective 3

Static Malware Analysis DFE Practice Questions (Page 2)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

51questions here

11free pages

9concepts

Questions 6–10

6application · medium
An analyst is examining the resources of a suspicious executable and finds a custom resource type named 'DATA' that contains a large binary blob. What is the most appropriate action?
Select an answer first
7application · medium
During static analysis of a suspicious executable, you extract the version information resource and find the company name 'Microsoft Corporation' and the product name 'Windows Update'. However, the file's digital signature is invalid. What is the most likely explanation?
Select an answer first
8expert · hard
A malware analyst is examining a suspicious executable and extracts a resource that contains a string that looks like a base64-encoded blob. The analyst decodes it and finds a URL. However, the URL is not present in the binary's strings. What is the most likely reason?
Select an answer first
9foundation · easy
What is the purpose of the PE header in a Windows executable?
Select an answer first
10foundation · easy
What is the primary characteristic of static malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.