350-201 Question 200
Select 3You are tasked with performing static malware analysis on a suspicious file discovered in your organization's network. Which of the following steps are appropriate for static malware analysis?
- A
Extract strings from the file to identify potential indicators of compromise (IOCs)
- B
Execute the file in a sandbox environment to observe its behavior
- C
Inspect the file's header and metadata for clues about its origin and functionality
- D
Disassemble the file using a tool to analyze its code structure
- E
Monitor network traffic generated by the file during its execution
Show answer and explanation
Correct answers: A, C, D
Explanation
Static malware analysis focuses on examining the characteristics of a file without executing it. Steps such as extracting strings, inspecting headers and metadata, and disassembling the code are key components of this process. Techniques that involve running the file, such as monitoring network traffic or sandboxing, fall under dynamic analysis and are not part of static analysis.
- A. Correct.
Extracting strings from the file is a common step in static malware analysis to identify potential IOCs such as URLs, IP addresses, or commands.
- B. Incorrect.
Executing the file in a sandbox environment involves dynamic analysis, not static analysis.
- C. Correct.
Inspecting the file's header and metadata is a fundamental part of static analysis to gather information about the file's origin, format, and potential purpose.
- D. Correct.
Disassembling the file to analyze its code structure is a key component of static malware analysis to understand its functionality without executing it.
- E. Incorrect.
Monitoring network traffic generated by the file is a dynamic analysis technique, as it requires the file to be executed.