A malware analyst is executing a sample in a sandbox. The sample detects that it is running in a virtual machine and refuses to execute its malicious payload. The analyst needs to observe the payload's behavior. Which action is most likely to succeed?

Use a debugger to patch out the VM check in the binary.

Run the sample in a different VM with more RAM and CPU cores.

Run the sample on a physical machine that is connected to the internet.

Use a bare-metal analysis system or a sandbox with anti-anti-VM features that hide virtualization artifacts.

A reverse engineer is analyzing a malware sample that uses a custom obfuscation technique. The code is heavily obfuscated and the analyst needs to understand the malware's logic. Which approach is most effective?

Run the malware in a sandbox and only observe its network traffic.

Submit the malware to an online analysis service and rely on its report.

Use a debugger to step through the code and observe the deobfuscated instructions at runtime.

Use a hex editor to manually decode the obfuscated bytes.

What is the primary focus of malware code analysis?

Understanding the logic and functionality of the malware by examining its code or disassembled instructions

Observing the malware's behavior in a sandbox

Identifying the malware's network command-and-control server

Determining the malware's file hash for detection

A malware sample uses a custom packer that also contains anti-VM and anti-debugging checks. The analyst needs to unpack the sample and analyze its code, but the sample refuses to run in the sandbox. Which approach is most likely to succeed?

Use a debugger to patch the anti-VM and anti-debugging checks, then dump the unpacked process memory

Run the sample in a different sandbox with more realistic hardware fingerprints

Perform static analysis on the packed binary and ignore the anti-VM checks

Submit the sample to an online sandbox that claims to bypass anti-VM techniques

What is the purpose of extracting malware artifacts during an investigation?

To identify the malware's author

To immediately delete the malware from the system

To preserve evidence for further analysis and potential legal proceedings

To speed up the infected system

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 9)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 41–45

41expert · hard
A malware analyst is executing a sample in a sandbox. The sample detects that it is running in a virtual machine and refuses to execute its malicious payload. The analyst needs to observe the payload's behavior. Which action is most likely to succeed?
Select an answer first
42application · medium
A reverse engineer is analyzing a malware sample that uses a custom obfuscation technique. The code is heavily obfuscated and the analyst needs to understand the malware's logic. Which approach is most effective?
Select an answer first
43foundation · easy
What is the primary focus of malware code analysis?
Select an answer first
44expert · hard
A malware sample uses a custom packer that also contains anti-VM and anti-debugging checks. The analyst needs to unpack the sample and analyze its code, but the sample refuses to run in the sandbox. Which approach is most likely to succeed?
Select an answer first
45foundation · easy
What is the purpose of extracting malware artifacts during an investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.