300-215 Question 43
Select 3During a forensic investigation, you suspect that a binary file may contain malicious code. You have access to tools like Ghidra, Radare, and Evans Debugger. Which of the following actions would help you perform basic static analysis and gain insights into the file’s functionality?
- A
Decompile the binary to retrieve a high-level representation of its code using Ghidra.
- B
Use Evans Debugger to modify the binary’s code and inject new functionality.
- C
Analyze the binary's control flow and function calls using Radare.
- D
Execute the binary in a sandbox environment to observe its runtime behavior.
- E
Examine the strings embedded within the binary to identify potential indicators of compromise.
Show answer and explanation
Correct answers: A, C, E
Explanation
Static analysis focuses on examining the binary file without executing it. Tools like Ghidra and Radare assist in disassembling and analyzing the binary’s structure, control flow, and function calls. Extracting strings from the binary can also provide critical insights into its potential behavior or indicators of compromise. Dynamic analysis techniques, such as executing the binary in a sandbox, are not part of basic static analysis using disassemblers and debuggers.
- A. Correct.
Decompiling the binary with a tool like Ghidra can help produce a high-level representation of the code, allowing you to understand its logic without executing it. This is a key part of static analysis.
- B. Incorrect.
Evans Debugger is typically used for debugging and analyzing runtime behavior, not for modifying binaries or injecting new functionality. This does not align with basic malware analysis.
- C. Correct.
Radare is a disassembler and debugger capable of analyzing control flow and function calls, which are critical for understanding the binary's structure and potential behavior.
- D. Incorrect.
Executing the binary in a sandbox environment is a dynamic analysis technique, not static analysis. While useful, it is outside the scope of disassemblers and debuggers for basic static analysis.
- E. Correct.
Examining embedded strings in the binary can reveal valuable information such as URLs, file paths, or command-and-control server addresses, making it a key step in basic static analysis.