300-215 Question 42
Select 3You are investigating a suspicious executable file discovered on a compromised endpoint. Your team has tasked you with performing a basic malware analysis using Ghidra. Which of the following actions should you take to analyze the malicious code effectively using Ghidra?
- A
Load the executable into Ghidra and analyze its disassembled code for potential malicious functions.
- B
Use Ghidra’s decompiler to review the high-level representation of the program for functionality analysis.
- C
Run the executable directly within Ghidra to observe its runtime behavior and interactions with the system.
- D
Identify and analyze API calls and strings in Ghidra to uncover potential indicators of malicious activity.
- E
Use Ghidra to automatically connect to the internet and download threat intelligence data for the executable.
Show answer and explanation
Correct answers: A, B, D
Explanation
Ghidra is a powerful static analysis tool used for reverse engineering and malware analysis. To effectively analyze a suspicious executable, you should focus on disassembling the code, using the decompiler to understand the program's functionality, and identifying key features like API calls and strings. Ghidra does not execute binaries or perform automatic threat intelligence gathering; those tasks require additional tools or techniques.
- A. Correct.
Loading the executable into Ghidra and analyzing its disassembled code is a key step to identify malicious functions and understand the program’s behavior.
- B. Correct.
Ghidra’s decompiler allows you to convert low-level machine code into a high-level representation, making it easier to understand the program’s functionality.
- C. Incorrect.
Running the executable directly within Ghidra is not a valid approach. Ghidra is a static analysis tool and does not execute binary files to observe runtime behavior.
- D. Correct.
Analyzing API calls and strings in Ghidra can provide valuable insights into the program’s potential malicious activity, such as identifying communication with command-and-control servers.
- E. Incorrect.
Ghidra does not include a feature to automatically connect to the internet and download threat intelligence data. Threat intelligence analysis must be performed using separate tools or platforms.