CHFI Mobile and Malware Forensics Practice Test 5 — 15 Questions

Question 1

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Answer

Making outbound TCP connections to an IP address

Answer

Creating a named mutex

Answer

Creating files in the %TEMP% directory

Question 2

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

Accepted Answer

UPX -d. The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer

Ghidra

Answer

Process Monitor

Answer

IDA Pro

Question 3

Which of the following is a key difference between static analysis and dynamic analysis in malware forensics?

Accepted Answer

Static analyzes the code without execution; dynamic executes the malware.. Static analysis involves examining the malware's code (e.g., disassembly, string extraction, hash analysis) without executing it, while dynamic analysis runs the malware in a controlled sandbox environment to observe its runtime behavior, such as file system changes, registry modifications, and network connections. This fundamental distinction is critical in malware forensics to safely understand the threat without risking infection.

Answer

Static analysis requires the malware to be executed, while dynamic analysis does not.

Answer

Static analysis is used only for packed malware, while dynamic analysis is used for unpacked.

Answer

Dynamic analysis uses tools like IDA Pro, while static uses Cuckoo Sandbox.

Question 4

During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?

Accepted Answer

Advanced logical extraction. C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

Answer

File system extraction

Answer

Physical extraction

Answer

Logical extraction

Question 5

A malware analyst is analyzing a suspicious executable. Which THREE of the following are valid indicators of compromise (IoCs) that can be extracted from static analysis of the PE file? (Select THREE)

Accepted Answer

IP addresses from embedded strings. Option A is correct because static analysis of a PE file routinely includes extracting embedded strings, and hardcoded IP addresses or URLs found in the binary are classic network-based IoCs that can be used for blocking and detection. Option C is correct because the MD5 hash of the file is a cryptographic file-based IoC computed directly from the sample without executing it, allowing analysts to pivot in threat-intelligence platforms and write hash-based detection rules. Option E is correct because the PE import table is parsed statically, and the list of imported DLLs and functions (e.g., CreateRemoteThread, VirtualAllocEx, WinINet APIs) reveals capabilities and is a valid host/behavioral IoC used in YARA and hunting rules. Option B is not correct because registry keys modified during execution can only be observed through dynamic analysis (e.g., Procmon, Regshot), not from static inspection of the PE file. Option D is not correct because file paths created during execution are also runtime artifacts revealed by dynamic analysis or sandboxing, not extractable from the static structure of the executable.

Answer

Registry keys modified during execution

Answer

File paths created during execution

Question 6

A security analyst observes a process on a Windows system creating a mutex named "Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}" shortly after execution. The analyst also notes outbound connections to an IP address 203.0.113.50 on port 4444. Which malware behaviour indicator is MOST clearly demonstrated?

Accepted Answer

Single-instance execution safeguard and command and control communication. The mutex name 'Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}' is a well-known technique used by malware to ensure only one instance of itself runs on the system, preventing conflicts or multiple infections. The outbound connection to 203.0.113.50 on TCP port 4444 is a classic indicator of command and control (C2) communication, as port 4444 is commonly associated with reverse shells and C2 traffic (e.g., Metasploit default). Together, these two behaviors directly demonstrate single-instance execution safeguard and C2 communication.

Answer

Anti-debugging technique through timing checks

Answer

File encryption using a hardcoded AES key

Answer

Persistence mechanism via registry run keys

Question 7

During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?

Accepted Answer

Process Monitor. Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

Answer

Wireshark

Answer

Regshot

Answer

Process Explorer

Question 8

An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?

Accepted Answer

Logical acquisition via ADB backup. The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.

Answer

Manual acquisition through device UI

Answer

Physical acquisition via JTAG

Answer

File system acquisition via dd

Question 9

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 10

Which of the following tools is BEST suited for performing static analysis of a malware binary to identify strings, headers, and imported functions without executing the file?

Accepted Answer

IDA Pro. IDA Pro is the correct choice because it is a disassembler and debugger specifically designed for static analysis of binary executables. It allows an analyst to examine strings, PE/ELF headers, and imported functions without executing the file, making it ideal for malware reverse engineering. In contrast, the other options require execution or focus on runtime behavior.

Answer

Cuckoo Sandbox

Answer

Any.run

Answer

Process Monitor

Question 11

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 12

A forensic examiner is analyzing an iOS device backup and wants to extract the user's iCloud-related artefacts. Which TWO of the following are typical sources of iCloud artefacts in an iTunes backup?

Accepted Answer

com.apple.accounts.plist. Option B, com.apple.accounts.plist, is correct because this property list stores the device's configured account information, including iCloud account identifiers and settings, making it a primary source of iCloud-related artefacts in an iTunes backup. Option D, the Keychain database (keychain-backup.plist), is correct because iCloud credentials and tokens are protected within the keychain, and the backup's keychain-backup.plist preserves these secrets for forensic examination. Option A, AddressBook.db, is incorrect because it holds local contact data rather than iCloud account artefacts. Option C, Call_history.db, is incorrect because it contains call log records, not iCloud configuration or credential data. Option E, SMS.db, is incorrect because it stores text message data, which is unrelated to iCloud account artefacts.

Answer

AddressBook.db

Answer

Call_history.db

Answer

SMS.db

Question 13

During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?

Accepted Answer

Network connection to 198.51.100.10:8080. The outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

Answer

MD5 hash of the original malware file

Answer

Mutex name created by the malware

Question 14

An Android forensic examiner performs a physical acquisition on a device. Which TWO of the following are typical artefacts that can be recovered from the /data/data/ directory on a non-rooted device if the acquisition method allows full file system access?

Accepted Answer

App-specific SQLite databases. Option D is correct because /data/data// is the private sandbox for each installed app, and apps commonly store their structured data in SQLite databases (e.g., /data/data/com.example.app/databases/*.db), which a full file-system acquisition can recover. Option E is correct because Android apps persist key-value settings in SharedPreferences, stored as XML files under /data/data//shared_prefs/*.xml, which are likewise recoverable with full file-system access. Options A, B, and C are not typical artefacts of /data/data/: bootloader configuration resides in bootloader/partition areas (e.g., /misc, /bootloader), recovery mode logs are produced by the recovery partition and typically stored in /cache/recovery/, and kernel logs come from the kernel ring buffer accessed via dmesg or /proc/kmsg, not from the app data directory.

Answer

Bootloader configuration

Answer

Recovery mode logs

Answer

Kernel logs

Question 15

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

Accepted Answer

Physical acquisition. Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition