CS0-003 · Question #319
During an incident in which a user machine was compromised, an analyst recovered a binary file that potentially caused the exploitation. Which of the following techniques could be used for further…
The correct answer is B. Static analysis. When analyzing a potentially malicious binary file recovered from a compromised machine, static analysis is an appropriate initial technique to examine its code without executing it.
Question
During an incident in which a user machine was compromised, an analyst recovered a binary file that potentially caused the exploitation. Which of the following techniques could be used for further analysis?
Options
- AFuzzing
- BStatic analysis
- CSandboxing
- DPacket capture
How the community answered
(14 responses)- A7% (1)
- B86% (12)
- D7% (1)
Why each option
When analyzing a potentially malicious binary file recovered from a compromised machine, static analysis is an appropriate initial technique to examine its code without executing it.
Fuzzing is a technique for finding software bugs and vulnerabilities by feeding random or invalid data to an application, which is not the primary method for initial analysis of a recovered malicious binary.
Static analysis involves examining the binary's code, structure, and metadata without actually executing it, which is crucial for understanding its potential functionality, identifying malicious patterns, and extracting indicators of compromise safely. This technique helps in understanding what the binary is designed to do before dynamic analysis or execution.
Sandboxing involves executing the binary in an isolated environment to observe its behavior, which is a form of dynamic analysis and is typically performed after static analysis to ensure safe execution.
Packet capture is used for analyzing network traffic, not for directly analyzing the content or behavior of a standalone binary file itself.
Concept tested: Binary file malware analysis techniques
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/advanced-analysis
Topics
Community Discussion
No community discussion yet for this question.