CHFI Mobile and Malware Forensics Practice Test 2 — 15 Questions

Question 1

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 2

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Accepted Answer

The IP address 185.10.68.12. The network C2 IP address is direct and actionable for blocklisting. Registry keys and mutex names can be used for detection but are less definitive for network defense.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 3

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Accepted Answer

Physical extraction using a JTAG or chip-off technique. Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Answer

Manual extraction through the user interface

Answer

Logical extraction via ADB

Answer

File system extraction

Question 4

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Accepted Answer

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Answer

Making outbound TCP connections to an IP address

Answer

Creating a named mutex

Answer

Creating files in the %TEMP% directory

Question 5

An iOS forensic analyst is examining data from an iCloud backup and finds a file named 'call_history.db'. Which SQLite table within this database is MOST likely to contain the duration and timestamp of each phone call?

Accepted Answer

call. In iOS, call history data is stored in the 'call_history.db' SQLite database, and the primary table containing call duration and timestamps is named 'call'. The 'call' table includes columns such as 'duration' (in seconds) and 'date' (as a Cocoa Core Data timestamp). This is the standard schema used by Apple's Phone app since iOS 4.

Answer

ZCONTACT

Answer

ZOBJECT

Answer

ZCALL

Question 6

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

Accepted Answer

UPX -d. The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer

Ghidra

Answer

Process Monitor

Answer

IDA Pro

Question 7

Which of the following is a key difference between static analysis and dynamic analysis in malware forensics?

Accepted Answer

Static analyzes the code without execution; dynamic executes the malware.. Option D is correct because static analysis involves examining the malware's code (e.g., disassembly, string extraction, hash analysis) without executing it, while dynamic analysis runs the malware in a controlled sandbox environment to observe its runtime behavior, such as file system changes, registry modifications, and network connections. This fundamental distinction is critical in malware forensics to safely understand the threat without risking infection.

Answer

Static analysis requires the malware to be executed, while dynamic analysis does not.

Answer

Static analysis is used only for packed malware, while dynamic analysis is used for unpacked.

Answer

Dynamic analysis uses tools like IDA Pro, while static uses Cuckoo Sandbox.

Question 8

A security analyst notices that a compromised Android device's /data/data/com.example.app/databases/ directory contains a database with tables named 'accounts', 'transactions', and 'settings'. Which type of forensic acquisition would be MOST appropriate to capture this app-specific data while preserving deleted records?

Accepted Answer

Physical extraction. Physical extraction creates a bit-for-bit copy of the entire flash memory, including unallocated space and deleted SQLite records that have not been overwritten. This is the only method that can recover deleted rows from the 'accounts', 'transactions', and 'settings' tables because logical and file-system extractions typically skip unallocated blocks. The /data/data/com.example.app/databases/ directory is protected by Android's sandboxing, but physical acquisition bypasses the OS and reads the raw NAND or eMMC blocks directly.

Answer

File system extraction

Answer

Logical extraction via ADB

Answer

Manual extraction via device UI

Question 9

During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?

Accepted Answer

Advanced logical extraction. C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

Answer

File system extraction

Answer

Physical extraction

Answer

Logical extraction

Question 10

A malware analyst is examining a PE file that has a section named '.tls' and imports from 'kernel32.dll' and 'ntdll.dll'. The entry point points to a small stub that decrypts the main code at runtime. Which of the following best describes this technique?

Accepted Answer

TLS callback-based decryption. The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

Answer

Code injection via Reflective DLL

Answer

Packing with UPX

Answer

Anti-debugging via NtGlobalFlag

Question 11

Which of the following mobile forensics tools is specifically designed to extract data from iOS devices by exploiting the device's bootrom vulnerability (e.g., checkm8) to perform a physical extraction?

Accepted Answer

GrayKey. GrayKey is correct because it is a mobile forensic tool specifically designed to exploit the checkm8 bootrom vulnerability (a permanent, unpatchable exploit affecting A5 to A11 chips) to perform a physical extraction of iOS devices. This allows bypassing the device's passcode and extracting the full file system, including encrypted data, without needing to jailbreak the device.

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Question 12

During dynamic analysis of a malware sample in Any.run, an analyst observes that the malware writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and also creates a scheduled task named 'UpdateTask'. Which anti-forensic technique is the malware MOST likely attempting to counter?

Accepted Answer

Log wiping. Persistence mechanisms like Run keys and scheduled tasks are often monitored by security tools. If malware attempts to delete or modify these after execution, it is trying to remove evidence of persistence, which is a form of log wiping or anti-forensics.

Answer

Packing

Answer

Encryption

Answer

Timestomping

Question 13

A mobile forensic examiner is analyzing an Android device that has been factory reset. Which TWO of the following artefacts are MOST likely to still be recoverable after a factory reset? (Select TWO)

Accepted Answer

SMS messages. SMS messages (A) are stored in the Android internal database file `/data/data/com.android.providers.telephony/databases/mmssms.db`. A factory reset typically only marks the database file's storage blocks as free in the ext4 filesystem without performing a secure wipe, leaving the raw data recoverable via forensic tools like Cellebrite or Oxygen Forensic until overwritten. Google account tokens (D) are stored in the AccountManager service's SQLite database under `/data/system/users/0/accounts.db` and in the `authtoken` table; even after a factory reset, the underlying NAND flash memory may retain these tokens due to wear-leveling and garbage collection delays, allowing recovery with chip-off or JTAG techniques.

Answer

Deleted applications' data

Answer

Call logs

Answer

Photos stored in internal storage

Question 14

A malware analyst is analyzing a suspicious executable. Which THREE of the following are valid indicators of compromise (IoCs) that can be extracted from static analysis of the PE file? (Select THREE)

Accepted Answer

IP addresses from embedded strings. Option A is correct because static analysis of a PE file involves examining the file without executing it. Embedded strings, such as IP addresses, can be extracted using tools like `strings` or `binwalk` and serve as IoCs indicating command-and-control servers or other network destinations. These strings are stored in the PE file's data sections and are directly observable in the binary.

Answer

Registry keys modified during execution

Answer

File paths created during execution

Question 15

Which THREE of the following are common techniques used by malware to achieve persistence on a Windows system? (Select THREE)

Accepted Answer

Creating a scheduled task. Creating a scheduled task is a common persistence technique because it allows malware to execute at predefined times or system events, such as user logon or system startup. The Windows Task Scheduler can run arbitrary executables with SYSTEM privileges, making it a reliable method for maintaining access even after a reboot.

Answer

Process hollowing

Answer

WMI event subscription