Static Malware Analysis DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst extracts strings from a malware sample and finds an IP address and a file path. What is the most reasonable interpretation?

   • AThe sample is definitely malicious because it contains an IP address.
   • BThe IP address may be a C2 server and the file path may be where the malware drops a payload.
   • CThe IP address and file path are irrelevant because they are just strings.
   • DThe IP address is definitely the C2 server and the file path is definitely the payload location.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which part of a Portable Executable (PE) file contains information about the sections, such as their names and sizes?

   • AThe section headers
   • BThe resource directory
   • CThe import table
   • DThe DOS header
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which property of a cryptographic hash makes it useful for file fingerprinting?

   • AThe hash is always the same length as the file
   • BThe hash can be reversed to recover the original file
   • CAny change in the file produces a different hash
   • DThe hash is unique to the file's name
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During static analysis of a malware sample, an analyst extracts the resources section and finds an embedded executable file. What is the most appropriate next step?

   • AExtract the embedded executable and analyze it as a separate sample.
   • BIgnore the embedded file because it is likely a false positive.
   • CDelete the embedded file to prevent accidental execution.
   • DRun the embedded file in a sandbox immediately.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   While analyzing a suspicious PE file, you notice that the section named .text has write permissions, and the import table includes VirtualAlloc and WriteProcessMemory. What is the most likely implication?

   • AThe file may be using process injection or unpacking techniques, as writable code sections and memory APIs are common in malware.
   • BThe file is a driver that requires write permissions to the code section.
   • CThe file is a benign program that uses Just-In-Time (JIT) compilation.
   • DThe file is a legitimate program that uses self-modifying code for optimization.
   Reveal Solution Discussion Select an answer first