350-201 Question 194
Select 4A cybersecurity analyst at a company receives a suspicious file from a user reporting unusual system behavior. The analyst uses dynamic malware analysis tools but cannot conclusively determine whether the file is malicious. Under which circumstances should the analyst identify the need for additional static malware analysis?
- A
The file contains obfuscated code that prevents dynamic analysis from producing meaningful results.
- B
The dynamic analysis environment crashes when attempting to execute the file.
- C
The file does not exhibit any malicious behavior during dynamic analysis, but the user reports persistent issues.
- D
The file has a valid digital signature that matches a known vendor.
- E
The file is a script and cannot be executed in the dynamic analysis environment.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Dynamic malware analysis is useful for observing the runtime behavior of files, but it has limitations, especially when dealing with obfuscation, anti-analysis techniques, or files that do not exhibit immediate malicious behavior. Static analysis complements dynamic analysis by providing a deeper inspection of the file's structure and code, helping cybersecurity professionals identify threats that are not apparent during execution.
- A. Correct.
Obfuscated code can hide malicious behavior, making it difficult for dynamic analysis tools to interpret the file. Static analysis can help uncover hidden code and identify potential threats.
- B. Correct.
If the dynamic analysis environment crashes, it may indicate the presence of anti-analysis techniques or other issues requiring further investigation through static analysis.
- C. Correct.
When the file does not exhibit malicious activity during dynamic analysis but the user reports unusual behavior, static analysis can provide deeper insights, such as identifying dormant malicious code.
- D. Incorrect.
A valid digital signature matching a known vendor typically indicates the file is legitimate, reducing the likelihood of needing additional static analysis.
- E. Correct.
Scripts often cannot be executed in sandbox environments designed for binary files. Static analysis can be used to inspect the script's content directly for potentially malicious commands.