350-201 Question 199
Select 3A security analyst is tasked with performing a static analysis of a suspicious executable file found in the organization's network. Which of the following steps should the analyst take during static malware analysis?
- A
Review the file's metadata such as timestamps and file size.
- B
Execute the file in a controlled sandbox environment to observe its behavior.
- C
Use a disassembler to inspect the binary code for malicious functions or indicators.
- D
Extract and analyze embedded strings within the file for potential indicators of compromise (IOCs).
- E
Monitor network traffic generated by the file during execution.
Show answer and explanation
Correct answers: A, C, D
Explanation
Static malware analysis involves examining a suspicious file without executing it. This includes reviewing metadata, analyzing binary code with tools like disassemblers, and extracting embedded strings for potential indicators. Steps like executing the file or monitoring network traffic fall under dynamic analysis, which is outside the scope of static analysis.
- A. Correct.
Reviewing metadata, such as timestamps and file size, is a crucial part of static malware analysis, as it can reveal clues about the file's origin or changes made by the attacker.
- B. Incorrect.
Executing the file in a sandbox environment is part of dynamic malware analysis, not static analysis. Static analysis focuses on examining the file without execution.
- C. Correct.
Using a disassembler is an essential step in static analysis to deconstruct the binary and understand the file's underlying code.
- D. Correct.
Extracting and analyzing strings can provide useful indicators such as URLs, IP addresses, or commands embedded in the file, making it a key step in static analysis.
- E. Incorrect.
Monitoring network traffic is part of dynamic malware analysis, as it requires the file to be executed to observe external communications.