An analyst is examining a suspicious Windows executable and wants to perform static analysis without executing it. Which technique provides information about what external libraries and functions the binary calls?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Portable Executable Import Address Table lists all external DLLs and functions the binary uses; imports like CreateRemoteThread, VirtualAllocEx, WriteProcessMemory suggest injection; WinInet/WinHTTP suggests C2 communication; CryptEncrypt suggests ransomware — all without executing the file. A is wrong because sandbox analysis involves executing the binary; the question asks for static analysis without execution.
Full explanation below image
Full Explanation
B is correct because the Portable Executable Import Address Table lists all external DLLs and functions the binary uses; imports like CreateRemoteThread, VirtualAllocEx, WriteProcessMemory suggest injection; WinInet/WinHTTP suggests C2 communication; CryptEncrypt suggests ransomware — all without executing the file. A is wrong because sandbox analysis involves executing the binary; the question asks for static analysis without execution. C is wrong because strings analysis is static and useful but shows readable strings, not structured import information about specific API functions called. D is wrong because certificate validation verifies the publisher's signature but does not reveal the binary's functional capabilities.