350-201 Question 195
Single answerA security analyst is investigating a suspicious file detected on a corporate endpoint. Initial dynamic malware analysis in a sandbox environment reveals that the file is attempting to connect to an external IP address, but the behavior appears incomplete and inconsistent. Which scenario would justify the need for additional static malware analysis?
- A
The malware's behavior is fully captured during dynamic analysis, and no additional artifacts are observed.
- B
The file exhibits obfuscation techniques, such as packed code or encrypted payloads, during initial inspection.
- C
The sandbox environment's network and system configurations are identical to the production environment.
- D
The malware shows signs of polymorphism, with each execution resulting in slight variations in behavior.
Show answer and explanation
Correct answer: B
Explanation
Static malware analysis is typically required when dynamic analysis fails to provide a complete understanding of the malware's behavior. In this scenario, the file exhibits obfuscation techniques, which prevent dynamic analysis from revealing the full functionality of the malware. Static analysis can help dissect the packed or encrypted code and uncover the malware's true intent.
- A. Incorrect.
If the malware's behavior is fully captured during dynamic analysis, there would be no immediate need for additional static analysis, as all required information has already been obtained.
- B. Correct.
Obfuscation techniques, such as packed code or encrypted payloads, often require static malware analysis to uncover the underlying code and understand its functionality. This justifies the need for additional static analysis.
- C. Incorrect.
If the sandbox environment closely mimics the production environment, it is more likely to reveal the malware's intended behavior during dynamic analysis, reducing the need for static analysis.
- D. Incorrect.
Polymorphic malware changes its code with each execution to evade signature-based detection, but this behavior is typically best analyzed dynamically rather than statically.