Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a malware sample that changes its file hash every time it is downloaded from different command-and-control servers. The sample's code remains functionally identical, but the binary layout differs. Which obfuscation technique is the malware using, and why does it complicate hash-based detection?

   • AMetamorphism, because the malware rewrites its entire code structure each time, but the hash remains the same
   • BEncryption, because the malware encrypts its payload with a fixed key, making each copy unique
   • CPolymorphism, because the malware mutates its code while preserving functionality, defeating static hash signatures
   • DPacking, because the malware is compressed and decompressed at runtime, changing the on-disk hash
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator notices that a workstation is communicating with a known malicious IP address at regular intervals. The workstation also has a new service that was not installed by the administrator. Which indicator of compromise (IoC) is most directly related to the regular communication with the malicious IP?

   • AUnusual network traffic
   • BUser account anomaly
   • CRegistry modification
   • DFile integrity change
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the malware lifecycle, which stage involves the malware ensuring it remains active across system reboots?

   • APayload delivery
   • BInitial infection
   • CExecution
   • DPersistence
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which malware obfuscation technique involves encrypting the malicious code and decrypting it at runtime to evade signature-based detection?

   • APacking
   • BEncryption
   • CPolymorphism
   • DMetamorphism
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A malware analyst is examining a suspicious binary. The binary's strings are not visible in a hex editor, and the file size is much smaller than expected. When executed in a sandbox, the binary unpacks itself in memory and runs. Which detection evasion technique is being used, and what is a reliable way to detect this malware?

   • APolymorphism; use static string analysis to find the decryption key
   • BMetamorphism; use hash-based detection on the original binary
   • CPacking; use dynamic analysis to observe the unpacked code in memory
   • DEncryption; use signature-based detection on the packed file
   Reveal Solution Discussion Select an answer first