350-201 Question 197
Select 4You are a security analyst tasked with performing static malware analysis on a suspicious executable file discovered in the network. Which of the following steps would be part of static malware analysis?
- A
Examining the file’s embedded strings for suspicious URLs or commands
- B
Disassembling the binary to analyze the program's instructions
- C
Executing the file in a sandbox environment to observe its behavior
- D
Extracting metadata from the file, such as compiler information and timestamps
- E
Analyzing network traffic generated by the malware during execution
- F
Checking the file's hash against known malware databases
Show answer and explanation
Correct answers: A, B, D, F
Explanation
Static malware analysis involves examining a file without executing it. This includes techniques such as inspecting embedded strings, disassembling the binary, extracting metadata, and comparing file hashes with known malware databases. Dynamic analysis, on the other hand, involves running the malware to observe its behavior, which is not part of static analysis.
- A. Correct.
Examining the file’s embedded strings is a common static malware analysis technique to identify potentially malicious indicators like URLs or commands without executing the file.
- B. Correct.
Disassembling the binary allows analysts to study the program's instructions statically, which is a key part of malware analysis without running the file.
- C. Incorrect.
Executing the file in a sandbox environment is part of dynamic malware analysis, not static analysis, as it involves running the file.
- D. Correct.
Extracting metadata such as compiler information and timestamps is a static analysis approach, as it doesn’t involve running the file.
- E. Incorrect.
Analyzing network traffic is a dynamic analysis activity since it involves monitoring the malware's behavior during execution.
- F. Correct.
Checking the file's hash against known malware databases is a static analysis method used to identify known malicious files without executing them.