CHFI Mobile and Malware Forensics Practice Question

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

⚠ Common exam trap

The trap is that candidates may assume the question only allows static analysis techniques, but dynamic methods like using a debugger (OllyDbg) are also effective for unpacking. Do not exclude valid dynamic options just because they involve execution.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Performing strings analysis on the packed binary

Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Renaming the file to .txt
Why it's wrong here
Renaming does not affect the packed code.
✓
Performing strings analysis on the packed binary
Why this is correct
Strings may reveal embedded data or unpacked code regions.
✓
Running PEiD to identify the packer
Why this is correct
PEiD can detect many common packers, guiding the analyst on how to unpack.
✗
Executing the sample in Cuckoo Sandbox
Why it's wrong here
Cuckoo Sandbox is a dynamic analysis tool, not static.
✓
Using OllyDbg to step through the unpacking routine
Why this is correct
OllyDbg is a debugger that can trace unpacking code.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question