350-201 Question 196
Single answerDuring an incident response investigation, a security analyst discovers a suspicious file that has evaded detection by endpoint protection tools. The analyst performs dynamic malware analysis, but the results are inconclusive as the malware appears to use anti-sandbox techniques. What is the best course of action to further analyze the file?
- A
Perform static malware analysis to examine the file's binary and code structure.
- B
Rerun dynamic analysis in the same sandbox environment to capture additional behaviors.
- C
Delete the file immediately to prevent further infections on the system.
- D
Send the file to a threat intelligence provider for automated analysis.
Show answer and explanation
Correct answer: A
Explanation
When dynamic malware analysis fails due to anti-sandbox techniques, static malware analysis becomes crucial. By examining the file's binary, code, and embedded strings, analysts can identify malicious functionality, locate indicators of compromise, and craft appropriate defenses. This approach is more effective than rerunning dynamic analysis or relying solely on external providers.
- A. Correct.
Static malware analysis is essential when dynamic analysis is inconclusive, especially if the malware uses anti-sandbox techniques. Examining the file's code, strings, and structure without executing it can provide critical insights.
- B. Incorrect.
Rerunning dynamic analysis in the same sandbox environment is unlikely to yield new results if the malware is specifically designed to evade that environment.
- C. Incorrect.
Deleting the file is not a best practice during an investigation because it eliminates a key artifact needed for further analysis and understanding of the threat.
- D. Incorrect.
Sending the file to a threat intelligence provider can be helpful, but it does not replace the need for internal analysis, especially when the organization's response depends on understanding the file's functionality in detail.