Malware Forensics ECSS Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   An analyst receives a suspicious executable from an incident. The file is packed with a custom packer, and the analyst suspects it may be a keylogger. The analyst must quickly determine whether the binary contains any embedded configuration strings without executing it. Which approach is most appropriate?

   • AAttempt to unpack the binary using a packer identification tool and then extract strings from the unpacked image
   • BRun the binary in a sandbox and capture its network traffic
   • CUse a hex editor to inspect the raw bytes and search for ASCII strings
   • DSubmit the binary to an online multi-AV scanner and review the detection names
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A malware analyst is reverse engineering a packed binary. After unpacking, the analyst loads the binary into a debugger and sets a breakpoint on the Windows API function 'CreateProcess'. What is the primary purpose of this breakpoint?

   • ATo identify the malware's packer
   • BTo observe when the malware creates a new process
   • CTo prevent the malware from executing
   • DTo decrypt the malware's strings
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   An analyst is investigating a malware infection where the malware self-replicates across network shares and also installs a backdoor. The malware does not require user interaction to spread. How should this malware be classified?

   • ARansomware with a worm component
   • BSpyware with a worm component
   • CTrojan with a worm component
   • DWorm with a backdoor payload
   Reveal Solution Discussion Select an answer first