CEH Practice Question: Malware, Social Engineering and Network Attacks
During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?
⚠ Common exam trap
Candidates often choose sandbox execution (Option D) or deep static analysis (Option A) because they seem thorough, but the CEH exam emphasizes the principle of 'least risk first' — using a hash lookup to avoid execution and save time during initial triage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Submit the file hash to VirusTotal
Submitting the file hash to VirusTotal is the best first step because it leverages aggregated antivirus engines and threat intelligence to quickly determine if the file is known malware, without any execution risk. This approach is fast, non-invasive, and provides immediate reputation data from over 70 security vendors, making it ideal for triage during incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disassemble the file using IDA Pro
Why it's wrong here
Disassembling a file using IDA Pro involves highly detailed, low-level reverse engineering of its machine code, which is an extremely time-consuming and specialized process. While crucial for understanding complex, unknown malware, it is not an efficient or appropriate first step during a ransomware incident response where rapid identification and containment are paramount. Initial triage prioritizes quicker methods to determine known maliciousness.
- ✓
Submit the file hash to VirusTotal
Why this is correct
Submitting the file's cryptographic hash (e.g., SHA256) to VirusTotal is an optimal initial step because it leverages a vast, aggregated threat intelligence database. This service quickly checks the hash against numerous antivirus engines, sandboxes, and community submissions, providing immediate insight into whether the file is known malware, its common names, and associated behaviors without requiring local execution or extensive analysis. This rapid identification is critical for efficient incident response triage.
- ✗
Perform static analysis using PEiD to identify compiler and packer
Why it's wrong here
Performing static analysis with PEiD primarily identifies the compiler, packer, or cryptor used in a Portable Executable (PE) file. While this information is valuable for subsequent, deeper reverse engineering by indicating potential obfuscation techniques, it does not directly confirm if the file is known ransomware or provide a comprehensive threat assessment. For initial triage, leveraging global threat intelligence via services like VirusTotal offers a more direct and immediate answer regarding the file's malicious reputation.
- ✗
Run the file in a sandbox and observe its behavior
Why it's wrong here
Running the file in a sandbox performs dynamic analysis, observing its real-time behavior such as file system modifications, network communications, and process interactions in a controlled environment. While essential for understanding the full capabilities of unknown or polymorphic malware, this process is inherently more time-consuming than a simple hash lookup. As a first step during an active ransomware incident, a quicker method to ascertain known maliciousness is prioritized to accelerate initial response actions.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.