An analyst is investigating an incident and needs to determine if a suspicious binary is known malware. The binary's SHA-256 hash is available. Which resource provides the fastest initial lookup against known malware databases?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because VirusTotal allows instant hash lookups against results from 70+ antivirus engines and threat intelligence sources; if the hash is known malware, results return in seconds without executing the binary. A is wrong because sandbox execution provides dynamic analysis but takes minutes and requires submitting the actual binary, not just the hash.
Full explanation below image
Full Explanation
B is correct because VirusTotal allows instant hash lookups against results from 70+ antivirus engines and threat intelligence sources; if the hash is known malware, results return in seconds without executing the binary. A is wrong because sandbox execution provides dynamic analysis but takes minutes and requires submitting the actual binary, not just the hash. C is wrong because vendor manual analysis takes days to weeks, not seconds. D is wrong because strings analysis provides static analysis clues about the binary's functionality but does not identify it against a known malware database.