CHFI Mobile and Malware Forensics Practice Test 7 — 15 Questions

Question 1

A security analyst runs the command `regshot64.exe compare` after executing malware. Regshot reports that the following registry key was created: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate`. Which conclusion is MOST likely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The malware installed a persistence mechanism. The registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate` is a standard Windows Run key, which automatically executes the specified program at user logon. By creating this key, the malware ensures it runs every time the user logs in, establishing persistence. This is a classic persistence mechanism, not an action related to encryption, file deletion, or network changes.

Answer

The malware encrypted the user's documents

Answer

The malware deleted a system file

Answer

The malware modified a network configuration

Question 2

In iOS forensics, which database file typically contains the call history, including incoming, outgoing, and missed calls?

Accepted Answer

call_history.db. In iOS forensics, the call history (incoming, outgoing, and missed calls) is stored in the SQLite database file named `call_history.db`. This database is located within the root domain of the iOS file system (typically under `/private/var/mobile/Library/CallHistoryDB/`) and contains tables such as `call` and `call_history` that record each call's direction, duration, timestamp, and associated contact identifier. The CHFI exam specifically tests this file as the authoritative source for call log evidence.

Answer

Notes.db

Answer

AddressBook.db

Answer

SMS.db

Question 3

Which of the following is an example of an anti-forensics technique used to hide malicious activity?

Accepted Answer

Timestomping. Timestomping is an anti-forensics technique that deliberately modifies file timestamps (e.g., MAC times: Modified, Accessed, Created) using tools like `touch` on Linux or `SetFileTime` on Windows. By altering these timestamps, an attacker can hide the true timeline of malicious file creation, modification, or access, thereby evading forensic timeline analysis and making it appear that malicious activity occurred at a different time or was part of legitimate system operations.

Answer

Running a sandbox

Answer

Creating a mutex

Answer

Generating a hash

Question 4

During a malware investigation, you find that a process named `svchost.exe` is making outbound connections to an IP address known to be malicious. What tool would be BEST to capture the network traffic for further analysis?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing and analyzing network traffic because it can intercept packets at the network interface level, allowing you to inspect the full payload and headers of outbound connections from `svchost.exe` to the malicious IP. This enables deep analysis of protocols, data exfiltration attempts, and command-and-control communication patterns, which is essential in malware forensics.

Answer

PEiD

Answer

Process Explorer

Answer

Regshot

Question 5

An analyst extracts an iTunes backup from a Windows computer. The backup contains a file manifest.plist with cryptographic hashes. What is the primary purpose of these hashes in the backup process?

Accepted Answer

To verify the integrity of the backup files. The cryptographic hashes in an iTunes backup's manifest.plist file are used to verify the integrity of the backup files. Each hash corresponds to a file in the backup, allowing the system to detect any corruption or tampering by comparing the stored hash against a newly computed hash of the file data.

Answer

To compress the backup data

Answer

To index the backup for faster searching

Answer

To encrypt the backup files

Question 6

Which tool can be used to extract evidence from Android devices through the Android Debug Bridge (ADB) and is often used for logical acquisition?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is a widely used forensic tool that leverages Android Debug Bridge (ADB) to perform logical acquisition of Android devices. ADB allows the tool to communicate with the device's operating system via USB debugging, enabling extraction of call logs, contacts, SMS, and application data without physical chip-off. This makes it the correct choice for logical acquisition over ADB.

Answer

PEiD

Answer

Cuckoo Sandbox

Answer

GrayKey

Question 7

In static malware analysis, what is the purpose of using a tool like PEiD?

Accepted Answer

To detect packers or compilers used in the PE file. PEiD is a static analysis tool that identifies packers, cryptors, and compilers embedded in Portable Executable (PE) files by scanning for known signatures in the file's entry point and section headers. This helps an analyst understand whether the malware is packed (obfuscated) and what tool was used to create or compress it, which is critical before attempting dynamic analysis or unpacking.

Answer

To monitor registry changes during execution

Answer

To disassemble the binary into assembly code

Answer

To analyze network traffic generated by the malware

Question 8

A forensic analyst is examining an Android device for evidence of a specific app's usage. Which TWO locations are MOST likely to contain app-specific data that can be recovered through a logical acquisition?

Accepted Answer

/data/data/. /data/data/ is the primary directory on Android devices where installed applications store their private data, including databases, shared preferences, and cache files. This directory is accessible through logical acquisition (e.g., ADB backup) and contains app-specific evidence such as user credentials, chat logs, and configuration files.

Answer

/system/bin/

Answer

/proc/

Answer

/init.rc

Question 9

During dynamic analysis of a malware sample, an analyst observes the following: creation of a mutex named `Global\{9A2D7E1C-3F4B-4A5E-9B8C-1D2E3F4A5B6C}`, a registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` named `WindowsUpdate`, and outbound TCP traffic to `203.0.113.5:443`. Which THREE of the following indicators of compromise (IoCs) should be documented?

Accepted Answer

Outbound TCP to `203.0.113.5:443`. Outbound TCP traffic to a specific IP address and port (203.0.113.5:443) is a classic network-based indicator of compromise (IoC). During dynamic analysis, this demonstrates the malware's command-and-control (C2) communication, often using HTTPS over port 443 to blend with legitimate traffic. Documenting this IoC allows defenders to block the endpoint and detect similar infections via network monitoring.

Answer

SHA256 hash of the malware sample

Answer

File path `C:\Windows\System32
otepad.exe`

Question 10

An incident responder is analyzing a compromised Windows workstation. Which TWO artifacts would provide the STRONGEST evidence of a malware persistence mechanism?

Accepted Answer

Registry Run key referencing a suspicious path. The Registry Run key (e.g., `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) is a classic and widely used persistence mechanism. A suspicious path under this key directly indicates that the malware is configured to execute automatically at user logon, providing strong evidence of persistence. This is a core artifact in Windows forensics for identifying auto-starting malware.

Answer

Event log entry for user login

Answer

Network share access logs

Answer

Browser history showing download of a suspicious file

Question 11

In malware static analysis, a PE file is examined. The section names include '.text', '.rdata', '.data', and '.rsrc'. The entry point is in the .text section. Which tool would be MOST appropriate to identify any packer that might be obfuscating the code?

Accepted Answer

PEiD. PEiD is specifically designed to detect packers, cryptors, and compilers by scanning PE files for known signatures in the entry point and section headers. Since the question asks for identifying a packer that obfuscates code, PEiD's signature-based detection directly targets this need, unlike general-purpose disassemblers or string extractors.

Answer

strings

Answer

Ghidra

Answer

IDA Pro

Question 12

During an iOS forensics investigation, an examiner wants to extract call history records from an iPhone backup. Which SQLite database file should be examined?

Accepted Answer

call_history.db. In iOS forensics, call history records are stored in the SQLite database file named 'call_history.db' (or 'CallHistory.storedata' in newer iOS versions). This database contains tables such as 'call' and 'ZCALLRECORD' that log incoming, outgoing, and missed calls along with timestamps and durations. Examining this file directly from an iTunes backup or device extraction provides the examiner with the complete call log.

Answer

SMS.db

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Question 13

A forensic analyst is examining an Android device and wants to recover Google account artefacts, such as the last sync timestamp and cached email addresses. Where on the device (in /data/data/) would these artefacts MOST likely be stored?

Accepted Answer

com.google.android.gms. The Google account artefacts, including the last sync timestamp and cached email addresses, are stored within the package 'com.google.android.gms' (Google Play Services). This package manages authentication tokens, sync settings, and account metadata in its databases (e.g., 'accounts.db' or 'gms_credentials.db') under /data/data/com.google.android.gms/databases/. The last sync timestamp is typically recorded in the 'sync_state' table, while cached email addresses appear in the 'accounts' table.

Answer

com.android.providers.telephony

Answer

com.android.providers.contacts

Answer

com.android.settings

Question 14

An incident responder finds a file named 'photo.jpg' on a compromised system. The file size is 2 MB and it is located in a temp directory. The file's SHA256 hash is 5d41402abc4b2a76b9719d911017c592. What is the BEST next step to determine if this file is malicious?

Accepted Answer

Compare the hash against known malware hashes in a threat intelligence database. Comparing the SHA256 hash of the file against a threat intelligence database (e.g., VirusTotal, AlienVault OTX) is the fastest, least intrusive method to determine if the file is known malware. Since the file is 2 MB and located in a temp directory, it could be a legitimate image or a disguised executable; hash comparison leverages existing threat intelligence without altering the evidence or risking system compromise.

Answer

Delete the file to prevent potential harm

Answer

Perform static analysis using IDA Pro to disassemble the file

Answer

Run the file in a sandbox environment to observe behavior

Question 15

Which mobile forensic tool is specifically designed to extract data from a wide range of mobile devices, including both iOS and Android, and is commonly used by law enforcement agencies?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is the correct answer because it is a dedicated hardware and software solution specifically engineered to extract data from a vast array of mobile devices, including iOS and Android, through both physical and logical acquisition methods. It is widely adopted by law enforcement agencies globally due to its ability to bypass lock screen security, support over 30,000 device profiles, and extract deleted data via advanced techniques like JTAG and chip-off.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager