Question

A SOC analyst receives a suspicious binary flagged by an endpoint agent. Before investing hours in dynamic and manual code analysis, the analyst wants to quickly determine whether the sample matches a previously catalogued threat family so the team can reuse existing IOCs and response procedures. Which action represents the correct FIRST step in the malware analysis process to achieve this goal efficiently?

Accepted Answer

Compute the file hash and query threat intelligence and antivirus reputation databases to check for known matches

Answer

Detonate the sample in an isolated sandbox and capture full packet traces before any other action

Answer

Load the binary into a disassembler and begin manual review of the decompiled functions

Answer

Unpack the binary and extract embedded strings to build custom YARA rules for the sample