Malware Forensics CHFI Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A malware analyst is reverse engineering a binary that uses a string-encryption routine. The analyst has identified the routine but it is called many times with different arguments. What is the most efficient way to extract all decrypted strings?

   • AManually trace each call and decode each string
   • BUse a disassembler to rename each string variable
   • CSearch the binary for the encrypted strings and use an online decoder
   • DUse a debugger script to set breakpoints on the routine and log the return values
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A malware analyst is reverse engineering a sample that uses a custom packer. The analyst has identified the unpacking routine and wants to dump the unpacked binary from memory. However, the malware has anti-dump protections that detect when a debugger is attached. Which technique is most effective for obtaining the unpacked binary?

   • ADisable the anti-dump check by patching the binary in a hex editor.
   • BRun the malware in a sandbox and capture the memory dump after execution.
   • CUse a debugger plugin or script to break at the end of the unpacking routine and dump the process memory before the anti-dump check executes.
   • DUse a static unpacker tool that can unpack the binary without executing it.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following tools is primarily used for reverse engineering malware by allowing an analyst to step through the code instruction by instruction?

   • AWireshark
   • BProcess Monitor
   • COllyDbg
   • DFTK Imager
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a malware evasion technique?

   • AUsing a well-known port like 80 for communication
   • BCreating a mutex to prevent multiple instances
   • CPacking the executable to compress and obfuscate its code
   • DWriting to the Windows Event Log
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic analyst received a suspicious executable from an incident response team. The file is packed with a custom packer, and the analyst needs to identify the original import table and any embedded strings without executing the sample. Which approach should the analyst use first?

   • AUse a static unpacker or script to unpack the binary, then inspect the unpacked PE with a disassembler
   • BRun the sample in a sandbox and capture the API calls it makes
   • CUse a PE viewer to examine the section headers and look for a suspicious .text section with high entropy
   • DSubmit the file hash to a public malware repository and rely on the report
   Reveal Solution Discussion Select an answer first