300-215 Question 45
Select 3During a malware analysis investigation, you are tasked with understanding the behavior of a suspicious binary. You decide to use a disassembler and debugger for static and dynamic analysis. Which of the following steps should you take to identify potential malicious functionality using Ghidra and Evans Debugger?
- A
Load the binary into Ghidra to analyze the decompiled code for suspicious function calls.
- B
Use Evans Debugger to execute the binary in a controlled environment and monitor runtime behavior.
- C
Rely entirely on the disassembly output from Ghidra without performing dynamic analysis.
- D
Use Ghidra to search for strings that might indicate URLs, file paths, or obfuscation techniques.
- E
Disable antivirus software to prevent interference during the analysis.
Show answer and explanation
Correct answers: A, B, D
Explanation
Effective malware analysis involves a combination of static and dynamic techniques to uncover the behavior of a malicious binary. Using tools like Ghidra for decompiling and analyzing code alongside Evans Debugger for runtime analysis ensures a comprehensive understanding of the malware. Searching for strings in Ghidra can further aid in identifying indicators of compromise. However, relying solely on static analysis or disabling antivirus software is not advisable.
- A. Correct.
Loading the binary into Ghidra allows you to analyze the decompiled code for suspicious function calls, enabling you to understand the binary's logic and potential malicious behavior.
- B. Correct.
Evans Debugger is used for dynamic analysis, allowing you to execute the binary in a controlled environment to observe its real-time behavior, such as system calls, memory usage, and interactions with the operating system.
- C. Incorrect.
Relying entirely on disassembly output is insufficient because static analysis alone may not uncover runtime behaviors such as obfuscation or conditional execution paths.
- D. Correct.
Using Ghidra to search for strings is a common technique for identifying indicators of compromise (IOC), such as hardcoded URLs or file paths, which may reveal the malware's intent or targets.
- E. Incorrect.
Disabling antivirus software is not recommended as it increases the risk of accidental infection and is not a best practice in a controlled malware analysis environment.