Static Malware Analysis DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst receives a suspicious executable from a user. Before submitting it to an online multi-engine scanner, the analyst wants to ensure the sample is not altered during transit and to allow correlation with other teams. Which action best achieves this?

   • ACompute the SHA-256 hash of the file and record it with the sample.
   • BRename the file to a neutral name and store it in a password-protected archive.
   • CCopy the file to a USB drive and physically transfer it to the malware lab.
   • DRun the file in a sandbox to observe its behavior before scanning.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analyst is reviewing the import table of a suspicious executable. The imports include CreateFile, WriteFile, InternetOpen, InternetConnect, and HttpSendRequest. What is the most reasonable inference about the malware's capabilities?

   • AIt is a ransomware that encrypts files and displays a ransom note.
   • BIt is a worm that spreads over the network.
   • CIt can perform file operations and network communication, potentially exfiltrating data.
   • DIt is a keylogger that captures keystrokes.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Why do analysts often use multiple antivirus engines to scan a malware sample?

   • ADifferent engines may detect different aspects of the malware
   • BTo remove the malware from the system
   • CTo ensure the sample is not a false positive
   • DTo determine the malware's origin
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What does a detection result from an antivirus engine indicate?

   • AThe file may be malicious, but further analysis is needed
   • BThe file is safe to execute
   • CThe file's hash is known to be benign
   • DThe file is definitely malware
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team is analyzing a suspicious executable. Static analysis reveals that the file is packed, and antivirus detection is low (2/60). The team has a limited budget and must decide whether to invest in manual unpacking and deep static analysis or to run the sample in a sandbox for dynamic analysis. What is the most appropriate decision?

   • ADo both in parallel to maximize information, regardless of cost.
   • BRun the sample in a sandbox for dynamic analysis because it can reveal behavior even if the packer resists static unpacking.
   • CInvest in manual unpacking and deep static analysis because it provides more detailed information about the malware's code.
   • DConclude that the file is benign because antivirus detection is low.
   Reveal Solution Discussion Select an answer first