A threat research lab is analyzing malware that employs polymorphic techniques to constantly modify its code structure. Which sequence of actions should the cybersecurity experts follow to gain a…

Question

Options

• APerform static code analysis, multiple sandbox runs, and pattern identification.
• BAnalyze network, dissect code, and observe behavior.
• CExecute dynamic analysis, examine code, and check network.
• DUse dynamic analysis, inspect code, and assess network.

• A
  64% (18)
• B
  11% (3)
• C
  4% (1)
• D
  21% (6)

Explanation

Option A is correct because polymorphic malware mutates its code structure on every execution, meaning a single analysis pass will miss most variants. The sequence - static code analysis first to examine the base structure, then multiple sandbox runs to capture different mutation iterations, then pattern identification - is specifically designed to handle this mutation behavior. The phrase "multiple sandbox runs" is the critical differentiator: since each execution produces a different code signature, one dynamic run is insufficient to understand the malware's full behavior range.

Options C and D are essentially the same workflow described with slightly different wording, and both fail for the same reason - they imply a single dynamic analysis pass, which won't reveal the full scope of a polymorphic sample's mutations. Option B front-loads network analysis before even examining code structure, which is an illogical sequencing for reverse engineering malware where code understanding should precede network observation.

Memory tip: Anchor on the prefix - "poly" means many. Polymorphic malware has many forms, so the correct answer must include multiple runs. Only option A says "multiple sandbox runs," making it the only choice built for malware that constantly reinvents itself.

No community discussion yet for this question.