ITPEC FE Morning October 2021 Question 41

Running the sample in a sandbox and observing its behavior and communication — dynamic analysis executes the malware, static analysis only inspects it.

Malware analysis is split by whether the sample is executed:

• •Dynamic analysis runs the sample in an isolated environment (a sandbox or virtual machine) and records what it does: processes it starts, files and settings it changes, hosts it contacts.
• •Static analysis examines the sample without running it: hash values, file headers, strings, disassembled or decompiled code.

Answer (d)

Why not others:

• •(a) — comparing the hash value with a database of known malware hashes is signature matching on the file; the sample never runs, so it is static.
• •(b) — checking file extensions against file headers inspects the file at rest; static.
• •(c) — reverse compiling the code and reading it to learn its functions is static code analysis, even though the sample was captured from network traffic.

Key rule: If the code is run and its behavior watched, the analysis is dynamic; anything that only reads the file or its code is static, and only dynamic analysis reveals behavior that obfuscated code hides.

Security · AI-written, may contain errors