CHFI Mobile and Malware Forensics Practice Test 2 — 15 Questions

Question 1

A malware analyst is examining a PE file that has a section named '.tls' and imports from 'kernel32.dll' and 'ntdll.dll'. The entry point points to a small stub that decrypts the main code at runtime. Which of the following best describes this technique?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TLS callback-based decryption. The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

Answer

Code injection via Reflective DLL

Answer

Packing with UPX

Answer

Anti-debugging via NtGlobalFlag

Question 2

Which of the following mobile forensics tools is specifically designed to extract data from iOS devices by exploiting the device's bootrom vulnerability (e.g., checkm8) to perform a physical extraction?

Accepted Answer

Cellebrite UFED. Cellebrite UFED is a mobile forensic tool that supports physical extraction from iOS devices by exploiting the checkm8 bootrom vulnerability (A5–A11 chips), enabling full file system acquisition without a passcode. GrayKey is an iOS-specific password bypass device that does not rely on a bootrom vulnerability as its primary method.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

GrayKey

Question 3

During dynamic analysis of a malware sample in Any.run, an analyst observes that the malware writes a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and also creates a scheduled task named 'UpdateTask'. Which anti-forensic technique is the malware MOST likely attempting to counter?

Accepted Answer

Log wiping. The malware creates persistence by adding a Run key and a scheduled task, ensuring it executes automatically upon system startup or at scheduled times. This persistence mechanism allows the malware to survive log wiping attempts (a common anti-forensic technique) because even if forensic analysts clear log files to remove evidence, the malware will run again and re-generate logs or continue its malicious activities, thereby countering the anti-forensic technique of log wiping.

Answer

Packing

Answer

Encryption

Answer

Timestomping

Question 4

A mobile forensic examiner is analyzing an Android device that has been factory reset. Which TWO of the following artefacts are MOST likely to still be recoverable after a factory reset? (Select TWO)

Accepted Answer

SMS messages. SMS messages (A) are stored in the Android internal database file `/data/data/com.android.providers.telephony/databases/mmssms.db`. A factory reset typically only marks the database file's storage blocks as free in the ext4 filesystem without performing a secure wipe, leaving the raw data recoverable via forensic tools like Cellebrite or Oxygen Forensic until overwritten. Google account tokens (D) are stored in the AccountManager service's SQLite database under `/data/system/users/0/accounts.db` and in the `authtoken` table; even after a factory reset, the underlying NAND flash memory may retain these tokens due to wear-leveling and garbage collection delays, allowing recovery with chip-off or JTAG techniques.

Answer

Deleted applications' data

Answer

Call logs

Answer

Photos stored in internal storage

Question 5

A malware analyst is analyzing a suspicious executable. Which THREE of the following are valid indicators of compromise (IoCs) that can be extracted from static analysis of the PE file? (Select THREE)

Accepted Answer

IP addresses from embedded strings. Static analysis of a PE file involves examining the file without executing it. Embedded strings, such as IP addresses, can be extracted using tools like `strings` or `binwalk` and serve as IoCs indicating command-and-control servers or other network destinations. These strings are stored in the PE file's data sections and are directly observable in the binary.

Answer

Registry keys modified during execution

Answer

File paths created during execution

Question 6

Which THREE of the following are common techniques used by malware to achieve persistence on a Windows system? (Select THREE)

Accepted Answer

Creating a scheduled task. Creating a scheduled task is a common persistence technique because it allows malware to execute at predefined times or system events, such as user logon or system startup. The Windows Task Scheduler can run arbitrary executables with SYSTEM privileges, making it a reliable method for maintaining access even after a reboot.

Answer

Process hollowing

Answer

WMI event subscription

Question 7

During a mobile forensic investigation of an iPhone, the examiner extracts data using a physical acquisition method. Which of the following BEST describes the level of data recovery achieved by this method?

Accepted Answer

It creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space. Physical acquisition creates a bit-for-bit copy of the entire NAND flash memory, including all sectors, deleted files, unallocated space, and remnants of previously stored data. This method bypasses the operating system's file system abstraction, allowing recovery of data that is not accessible through logical or file system acquisition techniques.

Answer

It recovers the file system but not deleted files

Answer

It extracts data via the user interface by manually interacting with the device

Answer

It recovers only logical files visible to the operating system

Question 8

A forensic analyst is examining an iOS backup taken from a suspect's iPhone using iTunes. Which of the following SQLite databases would contain the suspect's call history?

Accepted Answer

call_history.db. The call history on an iOS device is stored in a SQLite database named `call_history.db` (or `call_history.db` within the root domain of the user's backup). When an iTunes backup is created, this database is included in the backup manifest and can be extracted and queried to retrieve call logs, including timestamps, durations, and phone numbers. Option B is correct because it is the specific database that contains call history records.

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Answer

SMS.db

Question 9

A security analyst observes a process on a Windows system creating a mutex named "Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}" shortly after execution. The analyst also notes outbound connections to an IP address 203.0.113.50 on port 4444. Which malware behaviour indicator is MOST clearly demonstrated?

Accepted Answer

Single-instance execution safeguard and command and control communication. The mutex name 'Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}' is a well-known technique used by malware to ensure only one instance of itself runs on the system, preventing conflicts or multiple infections. The outbound connection to 203.0.113.50 on TCP port 4444 is a classic indicator of command and control (C2) communication, as port 4444 is commonly associated with reverse shells and C2 traffic (e.g., Metasploit default). Together, these two behaviors directly demonstrate single-instance execution safeguard and C2 communication.

Answer

Anti-debugging technique through timing checks

Answer

File encryption using a hardcoded AES key

Answer

Persistence mechanism via registry run keys

Question 10

During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?

Accepted Answer

Process Monitor. Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

Answer

Wireshark

Answer

Regshot

Answer

Process Explorer

Question 11

Which of the following mobile forensic tools is specifically known for its ability to perform advanced extractions on iOS devices, including bypassing the lock screen on many models?

Accepted Answer

GrayKey. GrayKey is specifically designed for advanced iOS extractions, leveraging a combination of hardware and software exploits to bypass the lock screen on many iPhone models, including recent ones. Unlike general-purpose forensic tools, GrayKey focuses exclusively on iOS and uses techniques like checkm8 bootrom exploit or brute-force attacks via USB to gain access to encrypted device data.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 12

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 13

Which of the following tools is BEST suited for performing static analysis of a malware binary to identify strings, headers, and imported functions without executing the file?

Accepted Answer

IDA Pro. IDA Pro is the correct choice because it is a disassembler and debugger specifically designed for static analysis of binary executables. It allows an analyst to examine strings, PE/ELF headers, and imported functions without executing the file, making it ideal for malware reverse engineering. In contrast, the other options require execution or focus on runtime behavior.

Answer

Cuckoo Sandbox

Answer

Any.run

Answer

Process Monitor

Question 14

A forensic examiner is analyzing an Android device and wants to extract the database containing the user's text messages (SMS). In which directory would the examiner typically find the SMS database on a non-rooted device?

Accepted Answer

/data/data/com.android.providers.telephony/databases/. The SMS database on Android devices is stored by the telephony provider, which manages SMS/MMS messages. On non-rooted devices, the database is located at /data/data/com.android.providers.telephony/databases/mmssms.db, as the package com.android.providers.telephony is the system application responsible for handling SMS and MMS operations.

Answer

/data/data/com.android.providers.contacts/databases/

Answer

/data/data/com.android.providers.calendar/databases/

Answer

/data/data/com.android.providers.downloads/databases/

Question 15

Which mobile forensic acquisition method is MOST likely to retrieve deleted text messages from an iPhone that was not jailbroken and has no passcode?

Accepted Answer

Physical acquisition via forensic tool like Cellebrite UFED. Physical acquisition (A) creates a bit-for-bit copy of the entire flash storage, including unallocated space where deleted text messages (stored in SQLite WAL/SHM/journal files) often reside. Since the iPhone has no passcode, the forensic tool can bypass the lock screen and access the raw NAND, allowing recovery of deleted records that logical or file-system methods cannot reach because they only copy allocated files.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by browsing the device

Answer

File system acquisition via AFC (Apple File Conduit)