312-49 · Question #552
Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?
The correct answer is B. Strings search. ResourcesExtract is a tool that extracts embedded resources - including readable strings - from executable (EXE/DLL) files without executing them. Using it to examine malware for embedded text (URLs, file paths, registry keys, IP addresses, error messages) is a form of static…
Question
Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?
Options
- AIdentifying File Dependencies
- BStrings search
- CDynamic analysis
- DFile obfuscation
How the community answered
(27 responses)- A4% (1)
- B93% (25)
- C4% (1)
Explanation
ResourcesExtract is a tool that extracts embedded resources - including readable strings - from executable (EXE/DLL) files without executing them. Using it to examine malware for embedded text (URLs, file paths, registry keys, IP addresses, error messages) is a form of static strings search analysis. Static analysis means the malware is not run; it is examined as a file. This is distinct from dynamic analysis (which involves executing the malware in a controlled environment) and file obfuscation analysis.
Topics
Community Discussion
No community discussion yet for this question.