As a forensic investigator specializing in cybersecurity, you've been assigned to analyze a suspicious PDF...

According to the CHFI v11 objectives underMalware ForensicsandStatic Malware Analysis, the correct initial step when analyzing a suspicious document—such as a potentially malicious PDF—is to performstatic analysis before any execution. Running the toolPDFiDusing the command python pdfid.py infected.pdf is a standard and CHFI-aligned first action. PDFiD is designed to quickly scan a PDF file and identify suspicious elements such as /JavaScript, /OpenAction, /Launch, /EmbeddedFile, and /AA, which are commonly abused by attackers to deliver malware through PDF documents.

This approach is non-intrusive and ensures the investigator does not accidentally trigger malicious code, thereby preserving evidence integrity and maintaining forensic soundness. Opening the file in a virtual machine (Option B) constitutesdynamic analysis, which should only be performed after initial static indicators suggest malicious intent and after proper containment controls are in place. Metadata extraction (Option C) is useful but limited, as metadata alone does not reliably expose embedded exploit code. Manual hex inspection (Option D) is advanced and time-consuming and is not recommended as the first step.

The CHFI v11 Exam Blueprint emphasizes astructured malware analysis workflow, starting with static analysis tools like PDFiD for suspicious documents, making Option A the most appropriate and exam-accurate answer