Malware Analysis Interview Questions

You receive a suspicious APK flagged by threat intel as a potential banking trojan. You have 30 minutes before the incident call. Walk through your analysis workflow from first opening the file to identifying the malicious behavior. Explain why you choose each step in the order you do.

A user reports that their MacBook fan runs constantly and the battery drains fast. EDR shows no alert, but Activity Monitor shows a process named com.apple.updated using high CPU, and its executable sits in the user's home directory. You have a remote shell on the Mac. How do you find and triage suspicious processes on this machine, and what would make you confident the process is malicious or benign?

You receive a malicious PowerShell script that appears heavily obfuscated. How do you analyze it?