Static Malware Analysis DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   While analyzing a Windows PE file, an analyst notices that the section named .text has write permissions (characteristics include 0xE0000020). What should the analyst consider?

   • AThe file is definitely a DLL because it has a writable section.
   • BThe file is benign because writable sections are common in legitimate software.
   • CThe file is definitely a 64-bit executable.
   • DThe executable may be packed or self-modifying, as code sections normally should not be writable.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center receives a suspicious file from an employee. The analyst computes an MD5 hash and finds it matches a known malware sample in a threat intelligence feed. However, the file's SHA-256 hash does not match any known sample. What is the most likely explanation?

   • AThe MD5 hash is the only reliable hash for malware identification.
   • BThe MD5 hash is unreliable and the file is definitely benign.
   • CThe file is a new variant of the known malware, and the MD5 match is coincidental.
   • DThe file has been modified or is a variant, so the MD5 matches but the SHA-256 differs.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   While inspecting a suspicious PE file, you notice that the import table contains only two functions: LoadLibraryA and GetProcAddress. The file also has a section named .UPX0 with unusual characteristics. What does this combination most likely indicate?

   • AThe file is packed or obfuscated, and the imports are dynamically resolved at runtime.
   • BThe file is a driver that uses kernel-mode APIs.
   • CThe file is a simple legitimate program that only needs those two functions.
   • DThe file is a DLL that exports those functions to other programs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst receives a suspicious executable from a user. The analyst computes a SHA-256 hash and submits it to a public malware repository, which returns no matches. The analyst then runs the file through several antivirus engines; only one engine flags it as malware. What is the most appropriate next step?

   • ARun the executable in a sandbox to confirm it is safe.
   • BConclude the file is benign and allow the user to run it.
   • CPerform static analysis on the PE structure and strings to gather more indicators before deciding.
   • DImmediately delete the file from the user's machine and move on.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst is examining a suspicious executable and finds that it imports InternetOpenA, HttpSendRequestA, and CreateFileA. What is the most reasonable inference about the executable's functionality?

   • AIt is a ransomware that encrypts files.
   • BIt likely downloads a file from the internet and saves it to disk.
   • CIt is a legitimate web browser because it uses internet APIs.
   • DIt is a keylogger that captures keystrokes.
   Reveal Solution Discussion Select an answer first