300-215 Question 44
Select 3During a malware investigation, you suspect that a suspicious executable contains obfuscated code designed to evade detection. You decide to use Ghidra to analyze the binary. Which of the following actions can you perform using Ghidra to assist in basic malware analysis?
- A
Decompile the binary into human-readable pseudocode to analyze its functionality.
- B
Dynamically execute the binary to observe runtime behavior and API calls.
- C
Identify strings and cross-references within the binary to locate potential indicators of compromise.
- D
Analyze the control flow graph of the binary to understand its execution logic.
- E
Modify and recompile the binary directly within Ghidra to test potential fixes.
Show answer and explanation
Correct answers: A, C, D
Explanation
Ghidra is a powerful reverse engineering tool that enables static analysis of binaries. It supports features such as decompiling code into pseudocode, identifying strings and cross-references, and visualizing control flow graphs, all of which are critical for basic malware analysis. However, it does not support dynamic execution or binary recompilation, which require other tools.
- A. Correct.
Decompiling the binary into human-readable pseudocode is a core feature of Ghidra, helping analysts understand the functionality of the suspected malware.
- B. Incorrect.
Ghidra does not support dynamic execution of binaries; this is typically performed using other tools, such as debuggers or sandbox environments.
- C. Correct.
Ghidra provides tools to identify strings and cross-references, which can help analysts pinpoint useful artifacts or indicators of compromise within the binary.
- D. Correct.
Analyzing the control flow graph is a key capability of Ghidra, allowing analysts to visualize and comprehend the execution logic of the binary.
- E. Incorrect.
While Ghidra supports binary analysis, it does not allow for directly modifying and recompiling binaries within the tool.