CEH Cryptography and Malware Analysis Practice Question
A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?
⚠ Common exam trap
Candidates often confuse tools like Nmap or Wireshark for malware analysis because they are commonly used in security investigations, but they lack the specific function of querying an online malware signature database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VirusTotal
VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is primarily used for network discovery and security auditing. It employs raw IP packets to determine hosts available on a network, their services, operating systems, and firewall status. While crucial for reconnaissance, Nmap does not possess any functionality to analyze a file's hash or query threat intelligence databases for malware detection. Therefore, it is unsuitable for investigating a suspicious file based on its cryptographic hash.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a free and open-source password cracking utility designed to detect weak Unix passwords and other types of credentials. It works by performing dictionary attacks, brute-force attacks, and other cryptographic attacks on password hashes. This tool's sole purpose is to recover passwords, not to analyze the characteristics or threat intelligence associated with a suspicious file's hash.
- ✓
VirusTotal
Why this is correct
VirusTotal is a web-based service that aggregates many antivirus products and online scan engines to check for viruses and other types of malicious content. A security analyst can submit a file's cryptographic hash (e.g., MD5, SHA1, SHA256) to VirusTotal, which then queries its extensive database and provides immediate detection results from numerous security vendors. This capability directly addresses the need to determine if a suspicious file is known malware by comparing its hash against a vast repository of threat intelligence.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer that allows users to interactively browse and inspect the data traveling on a computer network. It captures network traffic in real-time and displays it in a human-readable format, enabling deep inspection of individual packets. However, Wireshark's functionality is limited to network traffic analysis and does not include any features for submitting file hashes to threat intelligence platforms for malware identification.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.