Static Malware Analysis DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic analyst is examining a suspicious executable and finds that it imports CreateRemoteThread, OpenProcess, and VirtualAllocEx. The analyst also extracts strings that include a path to a legitimate system DLL. What is the most likely functionality of the malware?

   • AIt is a keylogger that hooks keyboard input.
   • BIt is a process injector that injects code into another process.
   • CIt is a network scanner that probes open ports.
   • DIt is a ransomware that encrypts files.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst uses Detect It Easy (DIE) on a suspicious executable and the tool reports 'UPX (Ultimate Packer for Executables)'. What is the most appropriate next step?

   • AIgnore the packing because it does not affect static analysis.
   • BAttempt to unpack the executable using the UPX tool.
   • CImmediately run the executable in a sandbox to observe its behavior.
   • DConclude that the file is malicious because it is packed.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of computing a hash (e.g., MD5, SHA-1, SHA-256) of a malware sample?

   • ATo uniquely identify the sample and track it across systems
   • BTo decrypt the malware's payload
   • CTo remove the malware from an infected system
   • DTo determine the malware's origin
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What can an analyst infer if a malware sample imports the function 'InternetOpenUrlA' from wininet.dll?

   • AThe malware creates a new process
   • BThe malware modifies the Windows registry
   • CThe malware likely performs network communication
   • DThe malware reads files from disk
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A malware analyst is examining a suspicious executable that is packed with a custom packer. The analyst attempts to unpack it manually but is unable to do so. The import table shows only LoadLibraryA and GetProcAddress. The analyst has limited time and must decide whether to continue static analysis or switch to dynamic analysis. What is the most appropriate decision?

   • AConclude that the file is benign because the import table is too small to be malware.
   • BSubmit the file to a third-party unpacking service and wait for the result.
   • CSwitch to dynamic analysis in a controlled sandbox to observe the malware's behavior after unpacking.
   • DContinue static analysis by examining the PE headers and sections in more detail.
   Reveal Solution Discussion Select an answer first