Static Malware Analysis DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst extracts printable strings from a suspected malware binary. The output shows only a few short strings such as 'MZ', 'UPX0', 'UPX1', and 'UPX!'. What is the most reasonable conclusion?

   • AThe binary is clean because it contains no suspicious URLs or IP addresses.
   • BThe binary is packed, and string extraction alone is insufficient to reveal its true indicators.
   • CThe binary is written in a low-level language that does not store strings in plaintext.
   • DThe binary is a legitimate installer that uses compression to reduce its size.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which task is part of static malware analysis?

   • AObserving registry changes on a live system
   • BCapturing memory dumps during execution
   • CExtracting strings from the binary
   • DExecuting the sample in a debugger to trace instructions
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which tool is commonly used to extract printable strings from a binary?

   • AVolatility
   • Btcpdump
   • CWireshark
   • Dstrings
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A malware analyst is performing static analysis on a suspicious executable. The file is packed, and the import table shows only the functions needed for unpacking. The analyst cannot find any suspicious strings or URLs. What is the most appropriate conclusion?

   • AThe file is a legitimate program that uses packing for compression.
   • BStatic analysis is complete and the file can be classified as clean.
   • CThe file is likely malware because it is packed, but static analysis alone cannot confirm its behavior.
   • DThe file is benign because no malicious indicators were found.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A malware analyst runs Detect It Easy (DIE) on a suspicious executable and the tool reports that the file is packed with UPX. The analyst also computes a SHA-256 hash of the file. What is the most appropriate next step?

   • ASubmit the packed file's hash to a malware repository to get a definitive verdict.
   • BSkip static analysis and immediately run the packed binary in a sandbox.
   • CUnpack the binary using UPX and then re-run static analysis tools on the unpacked file.
   • DConclude that the file is benign because UPX is a legitimate compression tool.
   Reveal Solution Discussion Select an answer first