Static vs Dynamic Malware Analysis

The video tutorial discusses malware analysis, focusing on static and dynamic methods. Static analysis involves examining APK files without executing them, while dynamic analysis observes app behavior in a controlled environment. The tutorial also covers malware distribution methods, including App Store uploads, phishing, compromised websites, and OS images. It highlights the risks of compromised source code and the potential for exploits in software. Finally, it addresses the dangers of losing physical control of devices, which can lead to unauthorized installations.

What is the primary focus of static analysis in mobile malware detection?

• Analyzing network traffic generated by the application

• Reviewing the APK file without executing it

• Examining user reviews on the App Store

• Running the application to observe its behavior

Why is it important to combine static and dynamic analysis techniques?

• To reduce the cost of analysis

• To ensure compatibility with all mobile devices

• To effectively analyze complex malware

• To increase the speed of analysis

Which distribution method involves disguising Trojans as legitimate applications on the App Store?

• Operating system image distribution

• App Store distribution

• Compromised website distribution

• Phishing-enabled distribution

How do phishing-enabled distributions typically coerce users into installing malicious applications?

• By providing fake software updates

• By sending links to APK files via SMS or email

• By offering free in-app purchases

• By exploiting device vulnerabilities

What risk is associated with distribution via operating system images?

• Slower device performance

• Increased battery consumption

• Incompatibility with certain devices

• Inclusion of Trojan applications in standard distributions

How can malicious actors use compromised source codes in malware distribution?

• By deleting the original source code

• By selling the source code to third parties

• By encrypting the source code

• By modifying the source code and uploading the application

What is a potential scenario where physical access to a device is used to install malware?

• During a routine maintenance check

• During a software update

• While the device is in the user's possession

• When the device is left unattended in a public place