312-50 Question 174
Single answer▪ Malware AnalysisDuring an internal incident response engagement, you receive a suspicious Windows executable from an endpoint that recently began beaconing to an unknown external IP. The client wants a quick assessment of whether the file is likely packed or obfuscated before approving deeper reverse engineering. You are working in an isolated malware analysis lab and must avoid executing the sample unnecessarily. Which action would provide the BEST initial evidence that the executable is packed or obfuscated?
- A
Run the executable in the production endpoint and capture its outbound traffic to confirm whether it decrypts itself at runtime
- B
Perform static analysis by checking entropy, imported functions, section names, and PE structure with tools such as PEview, Detect It Easy, or PEiD
- C
Open the file in a standard text editor and search manually for suspicious strings such as URLs and registry paths
- D
Submit the sample to the organization’s antivirus console and rely only on the vendor detection name to determine whether packing is present
Show answer and explanation
Correct answer: B
Explanation
For safe and efficient malware triage, analysts typically start with static analysis in an isolated lab before moving to controlled dynamic analysis. In Windows malware analysis, examining the Portable Executable structure is one of the best initial ways to identify packing or obfuscation. Common indicators include high entropy in sections, suspicious or generic section names, reduced imports due to runtime resolution, and anomalies in PE headers. This aligns with standard malware analysis workflows taught in CEH and commonly reflected in guidance from incident response and reverse engineering practices. Dynamic analysis may later confirm unpacking behavior, but it should occur in a sandboxed VM, not on a production host. Antivirus verdicts and raw text inspection can be helpful as supplementary inputs, but they are not the best standalone initial method for assessing packing.
- A. Incorrect.
This is incorrect because executing a suspicious binary on a production endpoint is unsafe and violates basic malware analysis containment practices. While dynamic analysis can reveal unpacking behavior, the scenario specifically asks for the best initial evidence without unnecessary execution. Best practice is to begin with static triage in an isolated environment before controlled execution in a sandbox or VM.
- B. Correct.
This is correct because static PE inspection is the standard first step for determining whether a Windows executable may be packed or obfuscated. Indicators such as unusually high entropy, very small or unusual import tables, suspicious section names, abnormal section permissions, and inconsistent PE metadata often suggest packing. Tools like PEview, Detect It Easy, and historically PEiD are commonly used for this purpose during triage.
- C. Incorrect.
This is incorrect because a text editor is not an effective primary method for identifying packing. Packed executables often hide or compress useful strings, so a lack of readable strings does not reliably prove anything by itself. A dedicated strings utility can support analysis, but PE structure and entropy checks provide stronger initial evidence.
- D. Incorrect.
This is incorrect because antivirus labels may indicate a family, heuristic suspicion, or generic trojan detection, but they are not a reliable or sufficient method for determining whether a sample is packed. Many benign and malicious files can be packed, and AV naming conventions vary widely by vendor. Malware analysts should validate with direct static indicators rather than depending solely on vendor classifications.