300-215 Question 194
Select 4During a forensic investigation, you are tasked with analyzing a suspicious binary file found on a compromised Linux server. You want to inspect the binary's disassembled instructions and its header information to identify potential malicious behavior. Which of the following tools and commands would be most appropriate to achieve this?
- A
Use the 'objdump -d' command to disassemble the binary and view its assembly instructions.
- B
Use the 'strings' command to extract readable text from the binary for clues about its behavior.
- C
Use the 'file' command to determine the type of file and ensure it is an executable binary.
- D
Use the 'bash' command to directly execute the binary and observe its runtime behavior.
- E
Use 'gdb' (GNU Debugger) to step through the binary's execution and analyze it at runtime.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Analyzing a binary requires using appropriate tools to extract meaningful information without risking further compromise. The 'objdump -d' command provides a disassembled view of the binary's instructions, while the 'strings' command can extract embedded human-readable data. The 'file' command identifies the type of file, ensuring it is an executable binary before further analysis. Additionally, 'gdb' enables dynamic runtime analysis of the binary without executing it recklessly. Directly running the binary using 'bash' is unsafe in a forensic context, as it could activate malicious payloads.
- A. Correct.
The 'objdump -d' command is designed to disassemble binaries and display their assembly instructions, making it one of the essential tools for binary analysis.
- B. Correct.
The 'strings' command is used to extract readable text (e.g., ASCII strings) from binary files, which can often reveal embedded information such as URLs, commands, or function names.
- C. Correct.
The 'file' command is useful for determining if the file is indeed a binary executable and its architecture, which is vital for choosing the correct tools for further analysis.
- D. Incorrect.
Executing the binary directly using 'bash' is highly risky without proper containment as it could trigger malicious behavior, potentially causing further damage to the system. It is not a recommended method for analysis.
- E. Correct.
'gdb' is a powerful tool for runtime analysis of binaries. It allows investigators to step through the program's execution, set breakpoints, and inspect memory, making it valuable for understanding binary behavior dynamically.