300-215 Question 195
Select 4During a forensic investigation, you are tasked with analyzing a suspicious binary file to identify malicious behavior. Using objdump and other CLI tools such as Linux utilities, Python, or Bash scripts, which of the following actions would help you extract executable instructions and identify potential indicators of compromise?
- A
Use
objdump -dto disassemble the binary and analyze its assembly code. - B
Leverage a Python script to calculate the hash of the binary for comparison with known malware signatures.
- C
Run the binary directly in the terminal to observe its behavior.
- D
Use
stringscommand to extract printable text from the binary. - E
Analyze the binary's file header using
objdump -xto gather metadata, such as entry point and section details.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
During forensic analysis, safe and effective methods such as disassembling the binary, calculating its hash, extracting readable strings, and inspecting its metadata are essential for identifying malicious behavior. Running the binary directly is unsafe and should be avoided as it could execute harmful operations.
- A. Correct.
Correct:
objdump -ddisassembles the binary, allowing you to inspect its assembly instructions and potentially identify malicious code patterns. - B. Correct.
Correct: Calculating the binary's hash using a Python script helps compare it against known malware databases or verify its integrity.
- C. Incorrect.
Incorrect: Running the binary directly can execute malicious code, posing a security risk and contaminating the investigation environment.
- D. Correct.
Correct: The
stringscommand extracts readable text from the binary, which can reveal clues like URLs, file paths, or commands used by the malware. - E. Correct.
Correct: Using
objdump -xprovides detailed metadata about the binary, such as the entry point and section table, which are critical for understanding its structure and behavior.