300-215 Question 192
Select 4During a forensic investigation, you are tasked with evaluating a suspicious file found on a compromised endpoint. The file has been identified as a Windows executable with unusual metadata and a high entropy score. Based on the distinguished characteristics of the file, what should be your next steps in the evaluation process?
- A
Submit the file to a sandbox environment for dynamic analysis
- B
Check the file's hash against a threat intelligence database
- C
Analyze the file’s strings for potential indicators of compromise
- D
Immediately delete the file from the endpoint to prevent further harm
- E
Perform static analysis by disassembling the file using a reverse engineering tool
Show answer and explanation
Correct answers: A, B, C, E
Explanation
When evaluating a suspicious file, it is important to gather as much information as possible about its behavior and characteristics through a combination of dynamic and static analysis techniques. Submitting the file to a sandbox, checking its hash against threat intelligence, analyzing its strings, and reverse engineering are all critical steps in this process. Deleting the file prematurely can result in the loss of valuable forensic data and should be avoided.
- A. Correct.
Submitting the file to a sandbox environment enables dynamic analysis by observing its behavior in a controlled setting, which is a critical step in understanding its intent.
- B. Correct.
Checking the file's hash against a threat intelligence database helps identify if the file is known to be malicious or has been previously associated with attacks.
- C. Correct.
Analyzing the file’s strings can reveal potential indicators of compromise, such as suspicious URLs, commands, or embedded malware signatures.
- D. Incorrect.
Immediately deleting the file is not recommended as it could erase valuable forensic evidence and impede the investigation.
- E. Correct.
Performing static analysis with reverse engineering tools allows for a detailed examination of the file’s structure and code without executing it, which is essential for identifying potential threats.