FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

Question

You are reviewing a scan job report for a potentially malicious PDF file that FortiSandbox has rated as clean. You notice a pattern of several procedure calls aimed at delaying execution, using large delay values (for example, 60+ seconds). These delay functions are interspersed between periods of benign network traffic directed to legitimate content delivery networks (CDNs) and common software update servers.

What modification must you make to account for this malware behavior?

Explanation

The malicious file is using long sleep/delay calls combined with innocuous network traffic to evade detection by outlasting the sandbox's analysis window. Since FortiSandbox's VM-based analysis only observes a sample for a configured duration, extending the VM scan timeout allows the sandbox to keep monitoring execution long enough to catch the malicious activity that occurs after the delay periods, rather than concluding the scan early and misclassifying the file as clean.

FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

AstroTutor

Notes

Readiness

QuestionQ39

Community Discussion