CEH Practice Question: Malware, Social Engineering and Network Attacks

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

⚠ Common exam trap

The CEH exam often tests that candidates mistakenly choose dynamic analysis (sandbox) as the first step, but the correct order is always static analysis first to assess risk and avoid executing unknown code prematurely.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Static analysis using strings and PEiD

Static analysis using tools like strings and PEiD should be performed first to quickly inspect the file's metadata, embedded strings, and packer information without executing it. Since the digital signature validation fails despite claiming to be from Microsoft, static analysis can reveal anomalies such as unusual section names, suspicious imports, or packed code that indicate tampering. This non-execution approach is safe and efficient for initial triage, avoiding the risks of dynamic analysis or running the file.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Upload to VirusTotal
Why it's wrong here
While VirusTotal offers valuable insights by aggregating results from numerous antivirus engines and community analysis, uploading an unknown executable, especially one found in a user's directory, is generally not the recommended first step. This action could inadvertently expose sensitive organizational data or intellectual property if the file contains proprietary information, leading to potential data leakage. Furthermore, relying solely on hash lookups might miss zero-day malware or custom variants not yet known to public databases, making it an incomplete initial assessment.
✗
Dynamic analysis in a sandbox
Why it's wrong here
Dynamic analysis, which involves executing the suspicious file in a controlled sandbox environment to observe its runtime behavior, is a critical phase in malware analysis. However, initiating dynamic analysis as the *first* step carries inherent risks, as even sophisticated sandboxes can sometimes be bypassed by advanced malware, potentially leading to an escape and compromise of the analysis environment or network. Prioritizing static analysis provides a safer initial assessment without execution, mitigating these potential risks.
✓
Static analysis using strings and PEiD
Why this is correct
Static analysis, particularly utilizing tools like `strings` and PEiD, is the safest and most appropriate initial step for examining a suspicious executable without execution. The `strings` utility can extract human-readable text from the binary, revealing potential commands, URLs, or error messages that often indicate malicious intent. PEiD (PE Identifier) helps analysts identify the compiler, packer, or cryptor used, which is crucial for understanding obfuscation techniques and guiding further analysis, all while minimizing risk.
✗
Run the file on a production system to observe behavior
Why it's wrong here
Executing a potentially malicious `svchost.exe` variant directly on a production system is an extremely reckless and dangerous action that violates fundamental security principles. This would almost certainly lead to immediate compromise of the host, potential lateral movement across the network, data exfiltration, or system disruption, causing significant operational damage and security breaches. Proper incident response protocols strictly forbid such actions, emphasizing containment and analysis in isolated, secure environments.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question