CHFI Mobile and Malware Forensics Practice Test 9 — 15 Questions

Question 1

An Android phone is seized, and the forensic examiner needs to acquire the device in a forensically sound manner. The phone is running Android 12 and has USB debugging enabled. Which acquisition method provides the most complete data without physically modifying the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical acquisition via ADB with appropriate exploit. Physical acquisition via ADB with an appropriate exploit allows the examiner to obtain a complete bit-for-bit copy of the device's flash memory, including deleted data and unallocated space, without physically modifying the device. Since Android 12 has USB debugging enabled, ADB can be used to push an exploit that bypasses security restrictions to perform a physical dump, which is the most comprehensive method available for this scenario.

Answer

File system acquisition via Cellebrite UFED

Answer

Logical acquisition through ADB backup

Answer

Manual extraction using screen captures

Question 2

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

Accepted Answer

Modifying the hosts file with an entry for 192.168.1.1. Modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Answer

Connecting to IP 185.130.5.21 on port 443

Answer

Writing temporary files to %TEMP%

Answer

Creating the mutex 'Global\Mtx_Update'

Question 3

A forensic investigator needs to analyze the keychain data from an iOS device backup. Which tool is specifically designed to decrypt and display iOS keychain contents?

Accepted Answer

Elcomsoft Phone Breaker. Elcomsoft Phone Breaker is specifically designed to decrypt and display iOS keychain contents from backups, including passwords, tokens, and cryptographic keys. It leverages techniques such as brute-force, dictionary attacks, and GPU acceleration to recover the backup password, then extracts and decrypts the keychain data using its own implementation of the keychain decryption process, deriving the necessary encryption keys from the recovered backup password.

Answer

Cellebrite UFED

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Question 4

An Android device is found with factory reset performed. The forensic examiner wants to recover as much data as possible. Which of the following artefacts is MOST likely to survive a factory reset and provide useful evidence?

Accepted Answer

Data stored on the external SD card. Factory reset wipes the /data partition, which includes /data/data/ (app data), AccountManager tokens, and system configuration files like wpa_supplicant.conf. However, external SD cards are typically not formatted during a factory reset because they are user-removable storage. Therefore, data stored on the external SD card (e.g., photos, videos, app backups) often survives intact and can provide valuable forensic evidence.

Answer

Deleted SQLite records from /data/data/

Answer

Google account authentication tokens stored in AccountManager

Answer

Wi-Fi passwords from wpa_supplicant.conf

Question 5

A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.

Answer

Cuckoo Sandbox

Answer

Ghidra

Answer

IDA Pro

Question 6

An incident responder receives an alert that a workstation is beaconing to a known malicious IP address. The responder captures network traffic and analyzes it with Wireshark. Which of the following would be an immediate indicator of compromise (IoC) visible in the traffic capture?

Accepted Answer

Repeated connections to a known malicious IP address on a non-standard port. Repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.

Answer

Large file transfers during off-hours

Answer

ARP requests from unknown MAC addresses

Answer

Encrypted payloads using TLS 1.3

Question 7

Which mobile forensic tool is commonly used to perform a physical extraction of an iOS device, including bypassing the lock screen on certain models?

Accepted Answer

GrayKey. GrayKey is a specialized hardware tool designed by Grayshift that performs physical extraction of iOS devices, including bypassing the lock screen on certain models (e.g., iPhone 5 through iPhone X) by exploiting bootrom vulnerabilities or using brute-force techniques. It is widely used in law enforcement for forensic acquisition of iOS devices where logical extraction is insufficient.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager

Question 8

A security analyst detects that a known malware sample writes to the registry key 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service. This behavior is characteristic of which type of persistence mechanism?

Accepted Answer

Windows service. The malware writes to 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service, which is the exact mechanism for registering a Windows service. This persistence method ensures the malware runs automatically when the system boots, as the Service Control Manager (SCM) loads services based on this registry key. Option D is correct because this behavior directly corresponds to the Windows service persistence technique.

Answer

Scheduled task

Answer

AppInit_DLLs

Answer

Startup folder entry

Question 9

During an Android forensic examination, the analyst uses ADB to run 'adb shell dumpsys batterystats --reset' before acquiring data. What is the MOST likely purpose of this command?

Accepted Answer

This command is not recommended in forensic acquisition as it may destroy potential evidence. The 'adb shell dumpsys batterystats --reset' command clears the battery statistics logs on the device. In forensic acquisition, any command that modifies or deletes data on the device is considered destructive to evidence. The reset operation removes historical battery data that may contain timestamps and app usage patterns, which could be critical evidence. Therefore, this command is not recommended in forensic acquisition as it may destroy potential evidence.

Answer

To clear battery logs that may contain evidence of app activity

Answer

To ensure the device is in a low-power state for safe extraction

Answer

To optimize device performance during imaging

Question 10

Which of the following is a key difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines code without execution, dynamic analysis executes the sample. Static malware analysis involves examining the malware's code (e.g., disassembly, strings, headers) without executing it, while dynamic analysis runs the sample in a controlled environment (e.g., sandbox, debugger) to observe its runtime behavior. Option C correctly captures this fundamental distinction: static analysis is code-centric and non-executional, whereas dynamic analysis is behavior-centric and executional.

Answer

Static analysis executes the malware, dynamic does not

Answer

Static analysis requires an internet connection, dynamic does not

Answer

Static analysis is always automated, dynamic is manual

Question 11

A forensic investigator is analyzing a Windows system suspected of malware infection. Which THREE of the following are common persistence mechanisms that malware may use?

Accepted Answer

Scheduled Tasks via schtasks. Scheduled Tasks via schtasks (A) are a common persistence mechanism because malware can register a task with the Task Scheduler service to execute its payload at logon, on a schedule, or on system events, surviving reboots. Creating a Windows service (B) is also a classic persistence technique, since services configured with auto-start (e.g., via sc.exe create or the Service Control Manager) launch automatically at boot under a privileged account. The Run key at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (E) is a well-known autostart location that Windows reads at user logon to launch listed programs, making it a favorite for malware persistence. Adding an entry to the hosts file (C) is not a persistence mechanism; it only redirects DNS resolution and does not cause code to execute. Modifying boot.ini (D) is not applicable to modern Windows systems, which use the Boot Configuration Data (BCD) store, and boot.ini was used only on legacy BIOS-based Windows XP/2003 systems.

Answer

Adding an entry to the hosts file

Answer

Modifying the boot.ini file

Question 12

A malware analyst is performing dynamic analysis of a suspicious executable in a Cuckoo Sandbox environment. Which THREE of the following behavioural indicators would be considered suspicious and warrant further investigation?

Accepted Answer

Creating a mutex with a hardcoded name. Option A is correct because creating a mutex with a hardcoded name is a classic malware behavior used to prevent multiple instances of the same infection from running simultaneously, and the specific name can serve as a host-based indicator of compromise (IOC) for detection and family identification. Option C is correct because modifying the hosts file to redirect a domain is a common technique for DNS hijacking, blocking security vendor updates, or redirecting legitimate traffic to attacker-controlled infrastructure, and it is highly suspicious in a sandbox run. Option E is correct because connecting to an IP address associated with a known command-and-control (C2) server is a direct indicator of malicious beaconing and exfiltration activity, and it is one of the strongest network-level IOCs in dynamic analysis. Option B is not suspicious because reading registry keys under HKLM\HARDWARE is a routine operation performed by many legitimate applications and drivers to enumerate hardware configuration. Option D is not suspicious because writing a temporary file to %TEMP% is normal behavior for a wide range of benign installers, updaters, and applications, so it does not by itself warrant further investigation.

Answer

Reading registry keys under HKLM\HARDWARE

Answer

Writing a temporary file to %TEMP%

Question 13

Which Android file system location is MOST likely to contain user-installed app data, preferences, and cached information?

Accepted Answer

/data/data/. The /data/data/ directory on Android devices stores application-specific data for user-installed apps, including preferences (shared preferences XML files), databases, and cached information. This location is part of the internal storage partition and is sandboxed per app, ensuring that each app can only access its own data directory. It is the primary repository for runtime app data, making it the most relevant for forensic analysis of user-installed app artifacts.

Answer

/vendor/

Answer

/system/

Answer

/mnt/sdcard/

Question 14

During a malware analysis, a suspicious executable is detected. The analyst runs `strings` on the binary and finds references to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` and a URL `http://evil.com/beacon`. What does this indicate?

Accepted Answer

The malware establishes persistence and communicates with a remote server. The presence of a registry key reference to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` indicates the malware is configured to launch automatically at system startup, establishing persistence. The embedded URL `http://evil.com/beacon` suggests the malware will make outbound HTTP requests to a remote command-and-control (C2) server for beaconing or data exfiltration. Together, these artifacts confirm persistence and remote communication, making option C correct.

Answer

The malware is a file infector that modifies system binaries

Answer

The malware uses a mutex for synchronization

Answer

The malware performs privilege escalation via a known vulnerability

Question 15

Which tool is specifically designed for dynamic analysis of malware by executing it in a controlled, isolated environment and logging its behavior?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed to execute suspicious files in a controlled, isolated environment (a sandbox) and log their behavior, including system calls, file system changes, network traffic, and memory dumps. Unlike static analysis tools, Cuckoo performs dynamic analysis by actually running the malware and observing its runtime actions.

Answer

PEiD

Answer

IDA Pro

Answer

Ghidra