ITPEC FE Morning October 2021 Question 41

Dynamic vs Static Malware Analysis — distinguish analysis methods by whether the malware is executed.

Dynamic analysis runs the malware in a controlled environment (sandbox) and observes its behavior: process creation, file changes, network communication.

Static analysis examines the malware without executing it: hash comparison, file header inspection, reverse engineering / decompilation.

Why each option:
- (a) Hash-based detection — compares hash against known malware database → static
- (b) File extension/header check — detects false extensions by examining headers → static
- (c) Reverse engineering — extracts and decompiles code from network data → static
- (d) Sandbox execution — runs malware and observes behavior/communication → dynamic ✔

Key rule: If the malware is executed and observed → dynamic. If only inspected without running → static.

AI-generated — may contain errors