What is the purpose of disassembling malware code?

To execute the malware and observe its behavior

To convert machine code into assembly language for analysis

To extract strings from the binary

A malware analyst is analyzing a new ransomware sample that is known to be polymorphic and uses a custom packer. The analyst needs to determine the ransomware's encryption routine and identify the C2 server. The analyst has a limited time and must choose between static and dynamic analysis. Which approach is most appropriate?

Perform static analysis first to identify the packer and extract strings, then use dynamic analysis to observe the encryption and C2 communication

Submit the sample to an online sandbox and rely on the automated report

Only perform dynamic analysis to observe the encryption and C2 communication directly

Only perform static analysis to avoid the risk of executing the ransomware

What is the purpose of packing in malware?

To reduce the size of the malware for easier distribution

To compress and obfuscate the malware code to evade detection

To ensure the malware is compatible with all operating systems

EC-CouncilCertified Security Specialist

Domain 6Objective 7

Malware Forensics ECSS Practice Questions (Page 7)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

43questions here

9free pages

10concepts

Questions 31–35

31foundation · easy
What is the purpose of disassembling malware code?
Select an answer first
32expert · hard
A malware analyst is analyzing a new ransomware sample that is known to be polymorphic and uses a custom packer. The analyst needs to determine the ransomware's encryption routine and identify the C2 server. The analyst has a limited time and must choose between static and dynamic analysis. Which approach is most appropriate?
Select an answer first
33foundation · easy
What is the purpose of packing in malware?
Select an answer first
34foundation · easy
A security analyst discovers a malicious program that replicates itself across network shares without any user interaction. Which malware classification best describes this?
Select an answer first
35foundation · easy
Which technique is used by malware to avoid being analyzed by security researchers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Forensics ECSS Practice Questions (Page 7)

Questions 31–35

What is the purpose of disassembling malware code?

What is the purpose of packing in malware?

A security analyst discovers a malicious program that replicates itself across network shares without any user interaction. Which malware classification best describes this?

Which technique is used by malware to avoid being analyzed by security researchers?

Keep studying — Digital Forensics Investigations