Malware Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a malware investigation, an analyst needs to preserve evidence from a live system before shutting it down. The analyst wants to capture the state of the system's memory and the malicious process's artifacts. Which action should be taken first?

   • ARun a network packet capture to record any ongoing communication.
   • BCreate a memory dump of the system using a trusted forensic tool.
   • CTake a screenshot of the desktop to document the current state.
   • DCopy the malicious executable from the disk to an external drive.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A malware analyst is examining a disassembled binary and notices that the code contains many conditional jumps that check the value of a specific CPU register. The register is set based on the result of a timing function. What is the malware likely doing?

   • AIt is likely communicating with a command-and-control server using a timing-based protocol.
   • BIt is likely performing a cryptographic operation that requires precise timing.
   • CIt is likely implementing anti-debugging or anti-sandbox logic by detecting timing differences.
   • DIt is likely generating a random number for encryption keys.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A malware analyst is about to execute a suspicious binary in a controlled environment. The goal is to observe its behavior, including file system changes, registry modifications, and network connections. Which setup is most appropriate?

   • AExecute the binary in a sandbox that blocks all network traffic and only logs process creation.
   • BUse a virtual machine with a snapshot, install monitoring tools, and capture network traffic with a packet analyzer.
   • CRun the binary on a dedicated physical machine that is disconnected from the network.
   • DRun the binary on a production server with endpoint protection enabled to see if it is detected.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A malware analyst is performing static analysis on a suspicious executable. The file has a valid digital signature, but the signature was issued to a company that is known to be a shell company. The analyst also notices that the file's version information contains a product name that does not match the company. What is the most likely conclusion?

   • AThe file is likely a legitimate application that was rebranded by the shell company.
   • BThe file is definitely benign because it has a valid digital signature.
   • CThe digital signature may have been obtained fraudulently or the file may have been tampered with after signing.
   • DThe file's signature is invalid because the product name does not match the company.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is analyzing a malware sample that uses encrypted communication with its C2 server. The analyst has captured the network traffic and identified the C2 server's IP address. However, the analyst cannot decrypt the traffic because the encryption key is not known. Which technique is most likely to allow the analyst to decrypt the traffic?

   • AUse a known plaintext attack on the captured traffic.
   • BUse a debugger to intercept the encryption function in the malware and extract the key from memory.
   • CUse a network analyzer to perform a man-in-the-middle attack on the malware's connection.
   • DSubmit the traffic to an online decryption service.
   Reveal Solution Discussion Select an answer first