CHFI Malware Forensics — 10 Questions

Question 1

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Accepted Answer

The file is packed or obfuscated to prevent execution in a sandbox. Option D is correct because malware authors often use packing or obfuscation techniques to prevent the malicious payload from executing in an analysis environment. The packed code requires a specific unpacking routine or trigger (e.g., a specific system call, registry key, or timing condition) that the sandbox does not provide, causing the file to appear inert. This is a common anti-sandbox technique distinct from simple signature evasion.

Answer

The file is a false positive and is actually benign

Answer

The sandbox is not updated with the latest signatures

Answer

The file's metadata has been modified to evade analysis

Question 2

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Accepted Answer

Acquire a memory dump and perform memory forensics with tools like Volatility. Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

Answer

Perform a full disk scan with updated antivirus signatures

Answer

Conduct a live analysis using built-in Windows tools like Task Manager

Answer

Analyze network traffic for anomalies using a NetFlow analyzer

Question 3

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

Accepted Answer

Create a bit-for-bit forensic image of the sample. Creating a bit-for-bit forensic image (option A) is the correct first step because it preserves the malware in an immutable, write-protected state, preventing any accidental execution or modification. This ensures the integrity of the evidence and allows the analyst to work with a safe copy without risking infection of the host system or network. In malware forensics, this aligns with the fundamental principle of maintaining a chain of custody and avoiding alteration of the original sample.

Answer

Execute the sample in a debugger on a production machine

Answer

Disassemble the binary using IDA Pro directly

Answer

Connect the sample to an isolated network to observe behavior

Question 4

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Accepted Answer

Code injection. Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 5

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers

Question 6

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Accepted Answer

Use a dedicated forensic workstation that is not connected to any network. Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

Answer

Delete the malware sample after analysis to prevent accidental infection

Answer

Run all analysis using the same tools and versions as the attacker

Question 7

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 8

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Accepted Answer

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. Option C is correct because the sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Answer

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Answer

Delete the suspicious file and run a full antivirus scan on the system

Answer

Perform a forensic imaging of the system again and compare with the original image

Question 9

Which TWO techniques are commonly used to evade detection by antivirus software in packed malware?

Accepted Answer

Polymorphic code. Polymorphic code (C) is correct because it mutates its decryption loop with each infection while preserving the original malicious payload, generating functionally equivalent but bytewise different code. This signature mutation evades signature-based antivirus detection by ensuring no static byte sequence remains constant across samples. Encryption with a variable key (E) is correct because it changes the decryption key per sample, producing different ciphertext each time and thus defeating signature matching on the encrypted payload.

Answer

Code obfuscation

Answer

Anti-debugging tricks

Answer

Anti-VM checks

Question 10

Based on the exhibit, what is the most likely indication of malware persistence?

Accepted Answer

services.exe is listening on TCP port 4444, indicating possible code injection. Option C is correct because services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

Answer

services.exe PID 4321 is a known malware process

Answer

Windows Defender service is stopped, allowing malware to run

Answer

svchost.exe hosting BFE and MpsSvc indicates a firewall bypass