Malware Forensics CHFI Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A malware sample is known to check for the presence of a virtual machine by looking for specific hardware strings. The analyst needs to run the sample in a sandbox to observe its behavior. Which of the following is the most effective way to avoid triggering the anti-VM check?

   • AUse a sandbox that has been modified to hide VM artifacts
   • BRun the sample on a physical machine with no network access
   • CUse a standard sandbox and accept that the malware may not execute fully
   • DPatch the malware's anti-VM check in a debugger before running it
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following tools is commonly used for static analysis of a Windows executable to view its PE header and imported functions?

   • AWireshark
   • BPEiD
   • CCFF Explorer
   • DProcess Monitor
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   During dynamic analysis, a malware sample uses a non-standard port (e.g., TCP 4444) to communicate with an external IP. The analyst suspects a reverse shell. What is the most definitive way to confirm this?

   • ACheck the malware's strings for 'cmd.exe' or '/bin/sh'
   • BRun a port scan against the external IP to see if it is listening
   • CUse a network analyzer to capture the payload and look for shell commands or interactive session indicators
   • DCheck the firewall logs for the connection
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following tools is used to monitor file system, registry, and process activity in real time during dynamic malware analysis?

   • AProcess Monitor
   • BRegshot
   • CPEiD
   • DWireshark
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst receives a suspicious executable from an internal user. The file has a valid digital signature from a known software vendor, but the user reports unusual network activity after running it. The analyst needs to determine whether the file is malicious without executing it. Which approach is most appropriate?

   • AInspect the PE headers, imports, and embedded strings, then compare the file hash against known malware databases.
   • BDisassemble the binary with a debugger and set breakpoints on API calls to trace its behavior.
   • CRun the executable in a sandbox and capture its network traffic to observe command-and-control behavior.
   • DSubmit the file to an online multi-scanner and wait for the aggregated detection results.
   Reveal Solution Discussion Select an answer first