350-201 Question 198
Select 3A cybersecurity analyst receives a suspicious executable file that is suspected to be malware. To perform static malware analysis, the analyst decides to investigate the file without executing it. Which of the following tasks should the analyst perform during static malware analysis?
- A
Disassembling the code to review its instructions and logic
- B
Executing the file in a controlled sandbox environment to observe its behavior
- C
Extracting strings within the binary to identify hardcoded URLs or commands
- D
Checking the file's hash against known malware databases
- E
Analyzing the file's network traffic in real-time to detect command-and-control communications
Show answer and explanation
Correct answers: A, C, D
Explanation
Static malware analysis involves examining the properties and code of a suspicious file without executing it. Techniques such as disassembling the code, extracting strings, and checking hashes against known malware databases are essential components of this process. Tasks like observing network traffic or running the file in a sandbox environment are part of dynamic malware analysis, which involves execution.
- A. Correct.
Disassembling the code is a core part of static analysis as it allows the analyst to examine the instructions and logic without executing the file.
- B. Incorrect.
Executing the file in a sandbox environment is part of dynamic malware analysis, not static malware analysis.
- C. Correct.
Extracting strings from the binary can reveal useful information such as hardcoded URLs, file paths, or commands, which is a common static analysis technique.
- D. Correct.
Checking the file's hash against known malware databases is a static analysis technique to quickly determine if the file matches known malware signatures.
- E. Incorrect.
Analyzing network traffic in real-time is a dynamic analysis method, as it requires the execution of the file to observe its network behavior.