CAS-005 · Question #298
A malware analyst must examine the following partial file sample recovered from a Linux workstation: Attempts to run the code in a sandbox produce no results. Which of the following should the…
The correct answer is A. Convert the hex-encoded sample to binary and attempt to decompile it. The sample is presented in hex format, not as a runnable binary. The correct next step is to convert the hex-encoded sample into its binary form and then attempt decompilation or disassembly. This allows the analyst to properly examine the executable structure and extract
Question
A malware analyst must examine the following partial file sample recovered from a Linux workstation:
Attempts to run the code in a sandbox produce no results. Which of the following should the malware analyst do next to further analyze the malware and discover useful IoCs?
Exhibits
Options
- AConvert the hex-encoded sample to binary and attempt to decompile it.
- BRun the encoded sample through an online vulnerability tool and check for any matches.
- CPad the beginning and end of the sample with binary executables and attempt to execute it.
- DUse a disassembler on the unencoded snippet to convert from binary to ASCII text.
How the community answered
(34 responses)- A71% (24)
- B18% (6)
- C3% (1)
- D9% (3)
Explanation
The sample is presented in hex format, not as a runnable binary. The correct next step is to convert the hex-encoded sample into its binary form and then attempt decompilation or disassembly. This allows the analyst to properly examine the executable structure and extract
Community Discussion
No community discussion yet for this question.