300-215 Question 196
Select 3During an incident response investigation, you have discovered a suspicious binary executable on a compromised Linux server. You need to analyze it for potential malicious behavior. Which of the following commands can be used to interpret the binary and gather useful information about its functionality?
- A
objdump -d
- B
strings
- C
python
- D
bash
- E
file
Show answer and explanation
Correct answers: A, B, E
Explanation
To analyze a suspicious binary, tools like 'objdump' and 'strings' are commonly used to extract meaningful information such as assembly instructions or embedded strings. The 'file' command can provide context about the binary's type. However, executing the binary directly with 'python' or 'bash' is not a safe or effective analysis method for this scenario.
- A. Correct.
The 'objdump -d' command disassembles the binary and provides low-level assembly instructions, which can help in understanding the binary's functionality and behavior.
- B. Correct.
The 'strings' command extracts printable strings from a binary. This can reveal embedded text, such as URLs, commands, or other indicators of compromise.
- C. Incorrect.
Running 'python
' assumes the binary is a Python script, but this is not appropriate for analyzing compiled executables. It will likely result in an error unless the binary is specifically a Python file. - D. Incorrect.
Running 'bash
' assumes the binary is a shell script. This is not a safe or correct way to analyze a suspicious compiled binary, as it could execute malicious code. - E. Correct.
The 'file' command determines the type of a file, which can provide quick insight into whether the binary is an ELF executable, a script, or another file type.