312-50 Question 173
Single answer▪ Malware AnalysisDuring an internal malware analysis engagement, a security team receives a suspicious Windows executable captured from a phishing campaign. Initial triage shows the file has a valid PE header but no obvious strings, and detonating it in a sandbox produces almost no visible behavior. The analyst suspects the sample is packed or obfuscated and wants to identify its original functionality without executing it extensively on the corporate network. Which action is the MOST appropriate next step?
- A
Run the executable directly on a production endpoint with EDR disabled to observe its full behavior
- B
Use a tool such as PEiD or Detect It Easy (DIE) to check for packing, then unpack or dump the process in an isolated analysis environment
- C
Delete the sample because files with hidden strings are too risky to analyze safely
- D
Convert the executable to a text file and review it in a standard editor to reveal the hidden code
Show answer and explanation
Correct answer: B
Explanation
This question tests practical malware analysis workflow. When a Windows PE sample has few readable strings and minimal sandbox behavior, packing or obfuscation is a reasonable suspicion. In that situation, analysts typically verify packing using tools such as PEiD or Detect It Easy (DIE), examine PE structure and section entropy, and then unpack the sample manually or by dumping the process after runtime unpacking in a controlled lab. This approach aligns with common malware triage and reverse-engineering practices: do not use production systems, preserve evidence, and perform analysis in isolated environments. Relevant best practices are consistent with guidance from malware analysis training methodologies and controlled detonation principles used by incident response teams and malware researchers.
- A. Incorrect.
Incorrect. Executing suspicious malware on a production endpoint is unsafe and violates basic malware analysis best practices. Disabling EDR further increases risk by removing protective controls and could allow persistence, lateral movement, or data exfiltration. Analysts should perform dynamic analysis only in a controlled, isolated lab or sandbox.
- B. Correct.
Correct. Packed malware often hides strings and reduces visible behavior during basic detonation. A standard next step is to identify whether the sample is packed using packer-detection tools such as PEiD or Detect It Easy (DIE). If packing is confirmed or strongly suspected, the analyst can unpack the binary statically or let it unpack in memory and then dump the process from an isolated malware analysis environment for deeper reverse engineering. This is a practical and commonly used workflow in real malware analysis.
- C. Incorrect.
Incorrect. Deleting the sample may remove evidence and prevent the team from identifying indicators of compromise, capabilities, or related campaign artifacts. The issue is not that the file is 'too risky' to analyze, but that it must be handled safely in an isolated environment with proper procedures.
- D. Incorrect.
Incorrect. Converting a PE executable to a text file does not reveal hidden code in any meaningful way. Executables are binary files, and packed or obfuscated code requires specialized analysis methods such as entropy checks, packer identification, disassembly, debugging, memory dumping, and sandboxing.