CHFI Malware Forensics — All Questions With Answers

Question 1

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Accepted Answer

The file is packed or obfuscated to prevent execution in a sandbox. Option D is correct because malware authors often use packing or obfuscation techniques to prevent the malicious payload from executing in an analysis environment. The packed code requires a specific unpacking routine or trigger (e.g., a specific system call, registry key, or timing condition) that the sandbox does not provide, causing the file to appear inert. This is a common anti-sandbox technique distinct from simple signature evasion.

Answer

The file is a false positive and is actually benign

Answer

The sandbox is not updated with the latest signatures

Answer

The file's metadata has been modified to evade analysis

Question 2

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Accepted Answer

Acquire a memory dump and perform memory forensics with tools like Volatility. Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

Answer

Perform a full disk scan with updated antivirus signatures

Answer

Conduct a live analysis using built-in Windows tools like Task Manager

Answer

Analyze network traffic for anomalies using a NetFlow analyzer

Question 3

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

Accepted Answer

Create a bit-for-bit forensic image of the sample. Creating a bit-for-bit forensic image (option A) is the correct first step because it preserves the malware in an immutable, write-protected state, preventing any accidental execution or modification. This ensures the integrity of the evidence and allows the analyst to work with a safe copy without risking infection of the host system or network. In malware forensics, this aligns with the fundamental principle of maintaining a chain of custody and avoiding alteration of the original sample.

Answer

Execute the sample in a debugger on a production machine

Answer

Disassemble the binary using IDA Pro directly

Answer

Connect the sample to an isolated network to observe behavior

Question 4

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Accepted Answer

Code injection. Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer

API hooking

Answer

Process hollowing

Answer

DLL injection

Question 5

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Accepted Answer

System calls returning inconsistent results. Option B is correct because rootkits operate at the kernel level, intercepting system calls to hide their presence. When a system call (e.g., NtQuerySystemInformation) is invoked, the rootkit modifies the return data to exclude malicious processes or files, causing the results to be inconsistent with the actual system state. This is a classic symptom of a kernel-mode rootkit that has hooked the System Service Dispatch Table (SSDT).

Answer

High CPU usage by svchost.exe

Answer

Unexpected open ports on the firewall

Answer

Presence of unsigned kernel drivers

Question 6

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Accepted Answer

Use a dedicated forensic workstation that is not connected to any network. Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

Answer

Delete the malware sample after analysis to prevent accidental infection

Answer

Run all analysis using the same tools and versions as the attacker

Question 7

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 8

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Accepted Answer

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. Option C is correct because the sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Answer

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Answer

Delete the suspicious file and run a full antivirus scan on the system

Answer

Perform a forensic imaging of the system again and compare with the original image

Question 9

Which TWO techniques are commonly used to evade detection by antivirus software in packed malware?

Accepted Answer

Polymorphic code. Polymorphic code (C) is correct because it mutates its decryption loop with each infection while preserving the original malicious payload, generating functionally equivalent but bytewise different code. This signature mutation evades signature-based antivirus detection by ensuring no static byte sequence remains constant across samples. Encryption with a variable key (E) is correct because it changes the decryption key per sample, producing different ciphertext each time and thus defeating signature matching on the encrypted payload.

Answer

Code obfuscation

Answer

Anti-debugging tricks

Answer

Anti-VM checks

Question 10

Based on the exhibit, what is the most likely indication of malware persistence?

Accepted Answer

services.exe is listening on TCP port 4444, indicating possible code injection. Option C is correct because services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

Answer

services.exe PID 4321 is a known malware process

Answer

Windows Defender service is stopped, allowing malware to run

Answer

svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

Question 11

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Accepted Answer

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.. Option D is correct because the primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution. Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Answer

Delete the config.ini file and the conhost.exe executable immediately.

Answer

Restore the system to a previous restore point.

Answer

Terminate the suspicious conhost.exe process and run a full antivirus scan.

Question 12

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Accepted Answer

Rundll32.exe with PID 1500 is likely a backdoor listening on port 4444.. Option D is correct because the netstat output shows a listening connection on port 4444 associated with PID 1500, which the tasklist command identifies as rundll32.exe. Port 4444 is a common backdoor port (often used by Metasploit or other RATs), and rundll32.exe is a legitimate Windows binary frequently abused by malware to host malicious code (e.g., via DLL sideloading or reflective injection). The combination of an unusual listening port and a process that is not a typical network service (like svchost.exe) strongly indicates a backdoor.

Answer

Svchost.exe processes are hosting legitimate Windows services; no malware is present.

Answer

The malware has injected code into svchost.exe using a reflective DLL injection tool.

Answer

The malware is using port 4444 for Windows Update communications.

Question 13

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce is a registry run key that executes programs once at user logon and then deletes the entry. Malware often uses this key to run a payload a single time, such as during initial infection or after a reboot, to establish persistence without leaving a continuous trace in the Run key.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 14

You are a forensic analyst investigating a Windows workstation that shows signs of malware infection. The user reports that the system is slow, network activity is high, and several files have been encrypted with a .encrypted extension. A ransom note named README.txt has been left on the desktop demanding payment. You have acquired a memory dump using FTK Imager and a disk image using dd. You need to identify the malware family and gather indicators of compromise (IOCs). Which of the following is the MOST appropriate first step?

Accepted Answer

Extract the ransom note and search for known ransomware identifiers such as Bitcoin wallet addresses or contact email.. Option A is correct because the ransom note (README.txt) is a primary source of ransomware identifiers such as Bitcoin wallet addresses, contact emails, or Tor payment site URLs. Extracting these IOCs from the note allows you to quickly cross-reference known ransomware families (e.g., Ryuk, Maze, LockBit) via threat intelligence feeds, which is the most efficient first step in malware forensics before deeper analysis.

Answer

Run the malware sample in a sandbox environment to observe its behavior.

Answer

Perform static analysis of the encrypted files to determine the encryption algorithm used.

Answer

Immediately disconnect the system from the network and power it off to preserve evidence.

Question 15

Drag and drop the steps to perform a forensic analysis of email headers to trace the origin of a spam email into the correct order.

Question 16

Match each steganography technique to its carrier medium.

CHFI Malware Forensics — All Questions With Answers

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Exhibit

Which TWO techniques are commonly used to evade detection by antivirus software in packed malware?

Based on the exhibit, what is the most likely indication of malware persistence?

Exhibit

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Exhibit

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Drag and drop the steps to perform a forensic analysis of email headers to trace the origin of a spam email into the correct order.

Match each steganography technique to its carrier medium.

CHFI Malware Forensics — All Questions With Answers

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Exhibit

Which TWO techniques are commonly used to evade detection by antivirus software in packed malware?

Based on the exhibit, what is the most likely indication of malware persistence?

Exhibit

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Exhibit

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Drag and drop the steps to perform a forensic analysis of email headers to trace the origin of a spam email into the correct order.

Match each steganography technique to its carrier medium.