300-215 Question 197
Select 4During a forensic investigation, you are analyzing a suspicious binary file that was flagged by your SOC. Using objdump and other CLI tools, you aim to determine if the binary contains malicious functionality. Which of the following steps would help you identify potential indicators of compromise (IOCs) effectively?
- A
Use objdump to disassemble the binary and review the assembly code for suspicious system calls or strings.
- B
Execute the binary directly on the production server to observe its behavior in real time.
- C
Use the 'strings' command to extract readable text from the binary and search for suspicious URLs, IP addresses, or function names.
- D
Run the binary through a sandbox environment to observe its behavior and network activity.
- E
Inspect the binary's file metadata using the 'file' command to determine its type and architecture.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Effective forensic analysis of a suspicious binary involves safe and methodical steps to extract information and identify IOCs. Tools like objdump, strings, and file provide insights into the binary's structure and contents, while sandboxing offers a controlled environment for behavioral analysis. Executing the binary on production systems, however, is highly discouraged due to the inherent risks of running potentially malicious code.
- A. Correct.
Using objdump to disassemble the binary is a critical step in analyzing its behavior. System calls or embedded strings could indicate malicious intent.
- B. Incorrect.
Executing the binary directly on a production server is highly risky and not a recommended practice as it could compromise the system.
- C. Correct.
The 'strings' command can reveal useful information such as URLs or IP addresses embedded in the binary, which are often used in malicious payloads.
- D. Correct.
Running the binary in a sandbox environment is a safe way to observe its behavior and detect IOCs without risking production systems.
- E. Correct.
Inspecting the binary's file metadata using the 'file' command can help you identify its type and architecture, which is essential for further analysis.