During dynamic malware analysis, a suspicious executable file is executed in a controlled, sandboxed environment. The malware exhibits behavior indicative of network communication and file…

Question

Options

• ATo observe the behavior and interactions of the malware without risking damage to the host
• BTo enhance the performance of the operating system
• CTo determine the author's identity
• DTo optimize the storage utilization of the system

• A
  81% (26)
• B
  13% (4)
• C
  3% (1)
• D
  3% (1)

Explanation

This question aligns with CHFI v11 objectives under Malware Forensics, specifically static vs. dynamic malware analysis and the use of sandboxed environments. Dynamic malware analysis involves executing a suspicious file in a controlled and isolated environment to safely observe its real-time behavior. CHFI v11 emphasizes that many modern malware samples use obfuscation, packing, or fileless techniques that conceal their functionality unless they are actually executed. The primary objective of running malware in a sandbox is to monitor its behavior without endangering production systems. Investigators can observe network communications (such as command-and-control traffic), file system changes, registry modifications, process injection, persistence mechanisms, and encryption activity. These behaviors provide critical indicators of compromise (IoCs) and help investigators understand the malware's capabilities, intent, and

No community discussion yet for this question.