CEH Practice Question: Malware, Social Engineering and Network Attacks
An incident response team discovers a suspicious executable on a compromised workstation. They want to analyze the malware without executing it. Which of the following techniques would be MOST appropriate for this initial analysis?
⚠ Common exam trap
It's easy for candidates to confuse 'dynamic analysis' techniques (like sandboxing or process monitoring) with 'static analysis', failing to recognize that the question's constraint 'without executing it' eliminates any option that requires runtime behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using the 'strings' command to extract embedded text
The 'strings' command extracts human-readable text from a binary file without executing it, making it ideal for static analysis. This technique can reveal indicators such as IP addresses, domain names, file paths, registry keys, or embedded commands that help classify the malware's purpose and capabilities without triggering its payload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Capturing network traffic with Wireshark during execution
Why it's wrong here
Capturing network traffic with Wireshark during execution is a dynamic analysis technique because it explicitly requires the suspicious executable to be run. Wireshark observes live network packets generated by the active process, providing insights into its communication patterns, C2 server interactions, or data exfiltration attempts only when the malware is operational.
- ✓
Using the 'strings' command to extract embedded text
Why this is correct
Using the 'strings' command is a quintessential static analysis method as it involves examining the binary file directly on disk without executing it. This command extracts sequences of printable ASCII or Unicode characters embedded within the executable, which can reveal valuable clues such as file paths, URLs, API function names, or error messages hardcoded by the malware author.
- ✗
Monitoring process behavior with Process Monitor
Why it's wrong here
Monitoring process behavior with Process Monitor is a classic example of dynamic analysis because it necessitates the execution of the suspicious file. Process Monitor captures real-time events related to file system access, registry modifications, and process/thread activity, providing a live operational view of the malware's actions as it runs on the system.
- ✗
Running the executable in a sandboxed environment
Why it's wrong here
Running the executable in a sandboxed environment is a form of dynamic analysis, despite its controlled nature. A sandbox provides an isolated, safe space to execute the malware and observe its runtime effects, such as creating new files, modifying registry keys, or attempting network connections, without risking damage to the host system.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.