Malware Analysis

IDA Pro and Ghidra are tools associated with which stage of malware analysis?

• Automated Analysis

• Static Analysis

• Dynamic Analysis

• Manual Code Reversing

Evaluating malware by examining it without executing it is what type of analysis?

• Sandboxing

• Static Analysis

• Dynamic Analysis

• Network Forensics

Which of the following tools monitor and capture the Windows file system, registry, and process activity in real time.

• Fiddler

• Process Monitor

• Process Explorer

• Process Hacker

Which of the following analysis tools will NOT identify file header information (e.g. Magic bytes, signatures etc..)?

• PEStudio

• Dependency Walker

• HxD

• ExeInfo PE

Which tools can aid in identifying command and control traffic from live malware samples? (Select all that apply)

• IDA Pro

• TCPDump

• Fiddler

• Wireshark

Which analysis tool can best aid in identifying malware persistence mechanisms?

• Regshot

• Wireshark

• Process Explorer

• Autoruns

Which of the following techniques are NOT associated with Fileless malware?

• memory injection

• windows manipulation

• script based

• code obfuscation

Bonus Question: Which Virtualbox network mode is often safest for a malware analysis lab?

• Internal

• Host-Only

• Bridged

• NAT

Which of the following is NOT part of the NIST Incident Response stages?

• Identification

• Preparation

• Detection & Analysis

• Containment

This native Linux command line tool can be used to find useful data in binary files.

• volatility

• grep

• strings

• xxd