CEH Practice Question: Malware, Social Engineering and Network Attacks
After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?
⚠ Common exam trap
Common confusion: Static analysis does not execute the file, while dynamic analysis runs it in a sandbox. Uploading to VirusTotal is a form of static analysis based on signatures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static analysis
The analyst is performing static analysis because they are examining the file without executing it. Running the 'strings' command extracts readable text from the binary, and uploading to VirusTotal checks the file's hash against known malware signatures — both are non-behavioral, non-runtime techniques. Static analysis focuses on file properties, code structure, and metadata without triggering the malware's execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static analysis
Why this is correct
Static analysis involves examining a file's properties and contents without executing it. Running the `strings` command extracts printable character sequences, providing clues about embedded text, URLs, or file paths. Uploading to VirusTotal leverages a multitude of static analysis engines and reputation databases to identify known malware signatures and indicators of compromise, all performed on the file at rest.
- ✗
Behavioral analysis
Why it's wrong here
Behavioral analysis focuses on observing the actions and interactions of a program as it executes within a controlled environment. This method tracks system calls, file system modifications, network communications, and process spawning to understand the malware's intent and operational tactics. Since the scenario explicitly states no execution occurred, there was no behavior to monitor, making this analysis type inapplicable.
- ✗
Code analysis
Why it's wrong here
Code analysis, such as reverse-engineering with a disassembler or debugger, examines the file’s internal logic and structure at the instruction level. The scenario describes only running `strings` and uploading to VirusTotal, which are static property extraction and reputation-checking techniques, not code-level dissection. This option is tempting because code analysis is a deeper static method, but it would be correct only if the analyst had decompiled the binary or analysed its assembly instructions.
- ✗
Dynamic analysis
Why it's wrong here
Dynamic analysis requires the execution of the suspicious file, typically within a secure sandbox or virtual machine, to observe its runtime behavior. This technique reveals how the program interacts with the operating system, network, and other processes in a live environment. As the scenario explicitly indicates that no execution took place, dynamic analysis could not have been performed to gather insights into the file's operational characteristics.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.