300-215 Question 41
Select 3During an incident response investigation, a suspicious executable file was discovered on a compromised endpoint. You have been tasked with performing a basic static malware analysis using disassemblers and debuggers. After loading the file into Ghidra, you observe several obfuscated functions and strings. Which of the following actions would be appropriate for further analysis using Ghidra or similar tools?
- A
Examine the disassembly to identify potential entry points and suspicious function calls.
- B
Use the debugger to step through the malware's code and analyze runtime behavior.
- C
Search for encrypted strings and attempt to decrypt them using Ghidra's decompiler.
- D
Export the disassembled code to a third-party tool for automated sandbox execution.
- E
Analyze imported libraries and API calls to identify potential malicious behavior.
Show answer and explanation
Correct answers: A, C, E
Explanation
Static malware analysis using tools like Ghidra involves examining disassembled code, analyzing strings, and understanding API calls or imported libraries to identify malicious behavior. Actions like examining disassembly, decrypting strings, and analyzing API calls align with the goals of static analysis, while stepping through code or sandboxing focus more on dynamic analysis.
- A. Correct.
Examining the disassembly is a fundamental step in static analysis. It helps identify key functions, suspicious entry points, and malicious logic.
- B. Incorrect.
While debugging is useful, it is typically a part of dynamic analysis rather than static analysis. This action isn't directly relevant to the question's scope.
- C. Correct.
Encrypted strings often hide critical information such as command-and-control URLs or malicious commands. Attempting to decrypt them using Ghidra's decompiler is a valid approach.
- D. Incorrect.
Exporting the disassembled code for sandbox execution is not a static analysis technique and is unrelated to using disassemblers or debuggers.
- E. Correct.
Analyzing imported libraries and API calls can provide insights into the malware's potential behavior, making this an important step in basic malware analysis.