Exam 312-50v12 topic 1 question 311 discussion

A. Upload the file to VirusTotal VirusTotal scans files using dozens of antivirus engines and provides a comprehensive report. This is a safe, non-invasive first step to check if the file is known malware. B. Immediately restore a previous snapshot While this is a good containment strategy if infection is confirmed, doing this without investigation might be excessive and could lead to loss of recent data or changes. C. Use netstat and check for outgoing connections This is a useful technique after suspecting infection, especially for malware communicating with command-and-control servers. However, it doesn't directly analyze the file and may miss silent or idle malware. D. Use ExifTool and check for malicious content ExifTool is primarily used for examining metadata in images and other media files, not executable files. It is not the right tool for inspecting potential malware in executables.

CEH v12 Module 04 p1187 One of Trojan countermeasures is to block all unnecessary ports at the host and use a firewall. Therefore, you should use Netstat to investigate for malicious activity first via checking outgoing connections in order to determine whether the computer is infected.