GIAC
GREM · Question #84
You are performing static analysis on a suspicious Windows executable. The file has an unusual section labeled .rsrc and imports numerous suspicious DLLs, such as advapi32.dll. What steps should you…
The correct answer is A. Review the imports to identify key functions that might suggest malicious behavior. B. Use a tool like Strings to extract any readable text from the binary. D. Analyze the PE header to understand the executable's structure. See the full explanation below for the reasoning.
Question
You are performing static analysis on a suspicious Windows executable. The file has an unusual section labeled .rsrc and imports numerous suspicious DLLs, such as advapi32.dll. What steps should you take to gather more information? (Choose three)
Options
- AReview the imports to identify key functions that might suggest malicious behavior.
- BUse a tool like Strings to extract any readable text from the binary.
- CPerform dynamic analysis to observe the behavior when the executable is run.
- DAnalyze the PE header to understand the executable's structure.
- EAttempt to execute the file to see if it triggers any network activity.
How the community answered
(59 responses)- A78% (46)
- C14% (8)
- E8% (5)
Community Discussion
No community discussion yet for this question.