An analyst is investigating a potentially malicious program. Static analysis showed suspicious header details, hashes, and strings embedded within the executable file. The analyst cannot determine…

Question

Options

• APerform interactive behavior analysis to understand how the file uses memory and connectivity to reveal behavioral characteristics.
• BAnalyze the static properties of the file as a part of the incident triage effort, summarize the results, and report to management that the file is suspicious, but indicators of compromise were not defined.
• CUse a limited guest account and production environment to determine the connectivity to reveal if the file uses the host as a command-and-control server.
• DAnalyze the program in antivirus engines and compare the file to the known malware to determine the attack vector of the file and define its attributes.

• A
  76% (31)
• B
  15% (6)
• C
  2% (1)
• D
  7% (3)

Explanation

When static analysis has been exhausted but hasn't revealed full indicators of compromise (IOCs), the logical next step is dynamic/behavioral analysis - actually executing the file in a controlled environment to observe what it does in memory, on the network, and on the filesystem. Option A (interactive behavior analysis) is exactly this escalation, revealing runtime behaviors that static strings and headers cannot.

Why the distractors fail:

• B is premature surrender - stopping analysis and reporting inconclusive results ignores available investigative techniques; analysts should not stop when behavior analysis is still an option.
• C is dangerously wrong on two fronts: using a production environment risks real infrastructure compromise, and a limited guest account is insufficient isolation for malware execution.
• D is a static technique (AV scanning and signature comparison) - it doesn't move beyond what was already attempted and won't reveal behavioral characteristics or novel IOCs.

Memory tip: Think of malware analysis as a two-phase ladder - Static → Dynamic. When static analysis (hashes, headers, strings, AV signatures) hits a wall, you climb up to dynamic/behavioral analysis (sandbox execution, memory inspection, network monitoring). Never go sideways to another static method, and never go to production.

No community discussion yet for this question.