CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?
⚠ Common exam trap
Many exam-takers assume any URL in a binary indicates a specific malware type (e.g., worm or keylogger), but the CEH exam tests the ability to infer functionality from evidence—HTTP URLs with `.exe` specifically point to remote payload download, not propagation or input capture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The malware may download additional payloads from remote servers
The `strings` command extracts printable strings from a binary file, and `grep -i http` filters for HTTP-related content. The presence of URLs ending with `.exe` indicates that the malware contains embedded references to executable files hosted on remote servers, which is a common technique for downloading additional payloads or updates. This strongly suggests the malware has a downloader or dropper component that fetches further malicious code from those URLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The malware may download additional payloads from remote servers
Why this is correct
The presence of HTTP URLs, particularly those ending with executable file extensions like .exe, is a strong indicator that the malware is designed to retrieve additional components. This behavior is characteristic of a downloader or dropper, which fetches secondary payloads from remote Command and Control (C2) servers to execute further malicious activities. Such multi-stage attacks are common, allowing the initial infection to be small and stealthy while dynamically loading more complex functionality.
- ✗
The malware has a keylogger component
Why it's wrong here
The absence of specific API calls or string patterns associated with keyboard monitoring strongly suggests the malware lacks a keylogger component. Keyloggers typically interact with Windows API functions such as SetWindowsHookEx or GetAsyncKeyState to capture keystrokes, or they might register for low-level keyboard events. Without these identifiable indicators in the file's static analysis, attributing keylogging functionality would be speculative.
- ✗
The malware is a boot sector virus
Why it's wrong here
A boot sector virus specifically targets and modifies the Master Boot Record (MBR) or Volume Boot Record (VBR) to execute before the operating system loads. The scenario of analyzing a 'suspicious file' typically implies a user-mode executable, which operates within the OS environment, not at the pre-boot stage. Therefore, the characteristics of a boot sector virus, which involve low-level disk manipulation and BIOS interaction, do not align with a standard file analysis context.
- ✗
The malware is a worm that spreads via email
Why it's wrong here
There are no indicators within the file's analysis, such as MAPI calls, SMTP client functions, or routines for harvesting email addresses, that suggest the malware is designed for email propagation. Worms that spread via email typically contain logic to access address books, compose and send messages, or attach themselves to outgoing emails. Without these specific functionalities, classifying it as an email-spreading worm is unfounded.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.