312-50 Question 172
Single answer▪ Malware AnalysisA security analyst receives a suspicious Windows executable from an endpoint that began beaconing to an unknown external IP after a user opened an email attachment. Management wants a quick initial assessment to determine whether the file is likely malicious and to identify potential indicators of compromise without detonating it on the production network. Which action is the BEST first step in a safe malware-analysis workflow?
- A
Execute the file on the affected user's workstation while capturing traffic with Wireshark to observe its behavior in the real environment
- B
Upload the file to a public file-sharing site and ask other administrators whether they have seen similar behavior
- C
Perform static analysis in an isolated environment by calculating hashes and inspecting strings, headers, imports, and embedded artifacts before any controlled execution
- D
Rename the file extension from .exe to .txt so the malware cannot run, then open it in Notepad to determine whether it is malicious
Show answer and explanation
Correct answer: C
Explanation
In a realistic CEH-style malware-analysis scenario, the analyst should begin with safe static triage rather than immediate execution. Best practice is to preserve the sample, calculate hashes such as SHA-256/MD5 for identification and chain-of-custody purposes, and inspect the file with static-analysis techniques: strings extraction, PE header review, import analysis, entropy checks, digital signature validation, and identification of suspicious artifacts like domains, registry paths, or mutex names. Only after this initial assessment should the analyst consider dynamic analysis in a properly isolated sandbox or lab network. This approach is consistent with common guidance from incident-response and malware-analysis best practices used by organizations such as CISA, NIST malware handling guidance, and standard digital forensics workflows emphasizing evidence preservation, containment, and least-risk analysis.
- A. Incorrect.
Incorrect. Running a suspicious executable on the affected user's workstation is unsafe and violates basic malware-analysis and incident-response practice. Even if network traffic is captured, execution on a production asset can worsen the compromise, trigger lateral movement, or destroy evidence. Controlled execution should only occur later in a sandbox or isolated lab after initial triage.
- B. Incorrect.
Incorrect. Sharing a suspected malware sample through an uncontrolled public site can expose others to risk and may violate organizational handling procedures. While threat-intelligence sharing can be useful, the first step should be internal safe triage. Analysts typically use vetted platforms such as internal malware repositories or approved malware-scanning services, following policy and legal constraints.
- C. Correct.
Correct. Static analysis is the safest and most appropriate first step for an initial assessment. Calculating cryptographic hashes helps identify known malware through reputation databases and enables evidence tracking. Inspecting strings, PE headers, imports, packer indicators, and embedded URLs/IPs can reveal suspicious capabilities and IOCs without executing the sample. This approach aligns with standard malware-analysis workflows: preserve evidence, analyze safely, then move to controlled dynamic analysis if needed.
- D. Incorrect.
Incorrect. Changing the file extension does not neutralize the sample as a forensic artifact or make analysis reliable. Opening a binary executable in Notepad is not a meaningful malware-analysis technique; it will mostly show unreadable data and can miss key metadata available through proper static-analysis tools. The misconception is that simple renaming or casual viewing is sufficient to assess risk.