Malware Analysis Quiz: Test Your Static vs. Dynamic Knowledge

📚 Quick Study Guide

• 🔍 Static Analysis: Examining malware code without executing it. Think of it like reading a blueprint.
• ⚙️ Dynamic Analysis: Executing malware in a controlled environment to observe its behavior. Like watching a machine in action.
• 📝 Static Techniques: Disassembly, string searching, header analysis.
• 🧪 Dynamic Techniques: Sandboxing, process monitoring, network traffic analysis.
• ⏱️ Trade-offs: Static analysis is faster but may miss obfuscated code. Dynamic analysis is more thorough but riskier and time-consuming.
• 🛡️ Key Tools (Static): IDA Pro, Ghidra, PEiD.
• 🌐 Key Tools (Dynamic): Wireshark, Process Monitor, Cuckoo Sandbox.
• 🚨 Malware Goals: Understand the malware's purpose, capabilities, and potential impact.

Practice Quiz

1. Which of the following describes static malware analysis?
   1. A. Executing the malware in a sandbox environment.
   2. B. Examining the malware's code without running it.
   3. C. Analyzing network traffic generated by the malware.
   4. D. Observing the malware's behavior on a live system.
2. What is a primary benefit of dynamic malware analysis?
   1. A. It is quicker to perform than static analysis.
   2. B. It can reveal behaviors hidden by obfuscation.
   3. C. It does not require any specialized tools.
   4. D. It is completely risk-free.
3. Which tool is commonly used for static analysis to disassemble executable files?
   1. A. Wireshark
   2. B. Process Monitor
   3. C. IDA Pro
   4. D. Regshot
4. Which of the following actions is a typical step in dynamic malware analysis?
   1. A. Calculating the MD5 hash of the file.
   2. B. Running the malware in a virtual machine.
   3. C. Examining the file's header information.
   4. D. Scanning the file with an antivirus program.
5. What is a potential disadvantage of dynamic malware analysis?
   1. A. It cannot detect encrypted malware.
   2. B. It is impossible to automate.
   3. C. It can be time-consuming and resource-intensive.
   4. D. It provides incomplete information about the malware.
6. Which analysis technique involves monitoring registry changes made by the malware?
   1. A. Static analysis
   2. B. Dynamic analysis
   3. C. Code review
   4. D. Fuzzing
7. Which of the following is NOT typically part of static analysis?
   1. A. String searching
   2. B. Disassembly
   3. C. Network traffic monitoring
   4. D. Header analysis