An incident response team is analyzing malware and observes the following: - Does not execute in a sandbox - No network loCs - No publicly known hash match - No process injection method detected Which

The correct answer is B. Check for an anti-virtualization code in the sample. Malware that does not execute in a sandbox environment often contains anti-analysis techniques, such as anti-virtualization code. This code detects when the malware is running in a virtualized environment and alters its behavior to avoid detection. Checking for anti-virtualizatio

Submitted by kavita_s· Mar 6, 2026Security Operations

Question

An incident response team is analyzing malware and observes the following:

Does not execute in a sandbox
No network loCs
No publicly known hash match
No process injection method detected

Which of the following should the team do next to proceed with further analysis?

Options

AUse an online vims analysis tool to analyze the sample
BCheck for an anti-virtualization code in the sample
CUtilize a new deployed machine to run the sample.
DSearch oilier internal sources for a new sample.

How the community answered

(32 responses)

A
13% (4)
B
63% (20)
C
19% (6)
D
6% (2)

Explanation

Malware that does not execute in a sandbox environment often contains anti-analysis techniques, such as anti-virtualization code. This code detects when the malware is running in a virtualized environment and alters its behavior to avoid detection. Checking for anti-virtualization code is a logical next step because: It helps determine if the malware is designed to evade analysis tools. Identifying such code can provide insights into the malware's behavior and intent. This step can also inform further analysis methods, such as running the malware on physical hardware.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice