A forensic analyst has completed the analysis of a banking trojan. The trojan uses a configuration file that is encrypted and contains the C2 server addresses. The analyst has successfully decrypted the configuration file. The incident response team needs to block the C2 communication and remove the malware from infected hosts. Which information from the analysis is most critical for the response team?

The trojan's persistence mechanism, such as the registry key it creates.

The decrypted C2 server addresses and the file hashes of the trojan executable.

The encryption algorithm and key used to encrypt the configuration file.

The programming language and compiler used to build the trojan.

A security team received a suspicious email attachment. The analyst needs to determine if the file is malicious and understand its capabilities. Which sequence of analysis steps is most appropriate?

Run the file directly on a production system to see what happens

Perform static analysis first, then dynamic analysis in a sandbox

Submit the file to an online scanner and rely solely on its verdict

Only perform dynamic analysis because static analysis is outdated

Which of the following is a common obfuscation technique that malware authors use to hinder code analysis?

Using meaningful variable names

Encoding strings to hide them from static analysis

Compiling the code with optimization flags

A reverse engineer is analyzing a malware sample that uses a virtual machine (VM) obfuscator to protect its code. The analyst wants to understand the malware's logic but the VM obfuscator makes the code extremely difficult to analyze. Which approach is most likely to be effective?

Search for the malware's source code on the internet.

Use a specialized VM deobfuscation tool or script to identify the VM handler and reconstruct the original instructions.

Use a debugger to step through the VM bytecode and manually translate each instruction.

Run the malware in a sandbox and observe its behavior to infer the logic.

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 11)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 51–55

51expert · hard
A forensic analyst has completed the analysis of a banking trojan. The trojan uses a configuration file that is encrypted and contains the C2 server addresses. The analyst has successfully decrypted the configuration file. The incident response team needs to block the C2 communication and remove the malware from infected hosts. Which information from the analysis is most critical for the response team?
Select an answer first
52application · medium
A security team received a suspicious email attachment. The analyst needs to determine if the file is malicious and understand its capabilities. Which sequence of analysis steps is most appropriate?
Select an answer first
53foundation · easy
Which of the following is a common obfuscation technique that malware authors use to hinder code analysis?
Select an answer first
54expert · hard
A reverse engineer is analyzing a malware sample that uses a virtual machine (VM) obfuscator to protect its code. The analyst wants to understand the malware's logic but the VM obfuscator makes the code extremely difficult to analyze. Which approach is most likely to be effective?
Select an answer first
55foundation · easy
Which of the following tools is a disassembler commonly used for static malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Malware Forensics CHFI Practice Questions (Page 11)

Questions 51–55

A security team received a suspicious email attachment. The analyst needs to determine if the file is malicious and understand its capabilities. Which sequence of analysis steps is most appropriate?

Which of the following is a common obfuscation technique that malware authors use to hinder code analysis?

A reverse engineer is analyzing a malware sample that uses a virtual machine (VM) obfuscator to protect its code. The analyst wants to understand the malware's logic but the VM obfuscator makes the code extremely difficult to analyze. Which approach is most likely to be effective?

Which of the following tools is a disassembler commonly used for static malware analysis?

Keep studying — Network and Malware Forensics