Static Malware Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst submits a suspicious file to VirusTotal and receives a detection ratio of 0/70. The analyst also computes a SHA-256 hash and finds no matches in public malware repositories. What is the most appropriate conclusion?

   • AThe file is definitely malware because it is not detected by any engine.
   • BThe file is a false negative and should be immediately quarantined.
   • CThe file is definitely benign because no antivirus engine detected it.
   • DThe file is likely benign, but further static analysis is needed to rule out malware.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A malware analyst is examining a Windows executable that shows a very small number of imports (only LoadLibrary and GetProcAddress) and a high entropy score in the .text section. The file also has an unusual section name '.vmp0'. The analyst needs to determine the actual behavior of the malware. Which approach is most appropriate?

   • ASubmit the packed binary to a multi-engine antivirus scanner and rely on the detection ratio to determine its behavior.
   • BRun the binary in a sandbox immediately to observe its behavior without attempting unpacking.
   • CConclude that the binary is benign because it has very few imports and no suspicious strings.
   • DAttempt to unpack or deobfuscate the binary using a tool tailored to the detected packer/protector, then re-run static analysis.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic analyst uses Detect It Easy (DIE) on a suspicious executable and the tool reports 'Entropy: 7.9' and 'Section .data has high entropy'. What is the most likely interpretation?

   • AThe file is a DLL that exports many functions, causing high entropy.
   • BThe file is likely packed or encrypted because high entropy indicates compressed or obfuscated data.
   • CThe file is definitely benign because high entropy is normal for all executables.
   • DThe file is a legitimate program that uses compression to reduce its size.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is performing static analysis on a malware sample that is packed with a custom packer. The analyst has successfully unpacked the binary and is now reviewing the imports. However, the imports still appear to be obfuscated, and the strings are encrypted. The analyst needs to determine the malware's command-and-control (C2) server address. Which approach is most effective?

   • ASearch the binary for any plaintext strings that might contain the C2 address.
   • BSubmit the unpacked binary to VirusTotal and look for the C2 address in the report.
   • CTry to decrypt the strings by guessing the encryption algorithm.
   • DUse dynamic analysis to observe network connections in a controlled environment.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is examining the resources of a suspicious executable and finds a version information resource that claims the product is 'Microsoft Windows Update'. The file's digital signature is invalid. What is the most reasonable inference?

   • AThe version information is likely spoofed to make the malware appear legitimate.
   • BThe file is a false positive and should be ignored.
   • CThe file is definitely malware because it has an invalid signature.
   • DThe file is a legitimate Microsoft binary because the version info matches.
   Reveal Solution Discussion Select an answer first