CEH Practice Question: Malware, Social Engineering and Network Attacks

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

⚠ Common exam trap

Watch out — candidates often assume 'no static indicators' means the file is benign, ignoring that packing is a deliberate evasion technique, and that dynamic analysis (sandbox execution) is essential to uncover hidden malicious behavior.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The file is likely a packed trojan that evades signature-based detection

The absence of readable strings and zero VirusTotal detections strongly suggest the executable is packed or obfuscated, a common evasion technique used by trojans. The sandbox behavior—connecting to a remote IP and injecting code into explorer.exe—confirms malicious intent, specifically trojan-like remote access and process injection. This combination of static stealth and dynamic malicious activity indicates a packed trojan designed to bypass signature-based antivirus.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The file is a worm because it connects to a remote IP
Why it's wrong here
A worm's defining characteristic is its ability to self-replicate and spread autonomously across networks without user intervention. While connecting to a remote IP is indicative of command-and-control (C2) communication, a common trait of many malware types including trojans, it does not confirm self-replication or propagation mechanisms unique to worms. Therefore, a remote connection alone is insufficient evidence to classify a file as a worm.
✓
The file is likely a packed trojan that evades signature-based detection
Why this is correct
The absence of discernible strings during static analysis and zero detections by antivirus engines strongly suggest the file is packed or heavily obfuscated to evade signature-based detection. Subsequent dynamic analysis in a sandbox environment, revealing malicious behaviors such as network connections to suspicious IPs or process injection, confirms its true malicious intent. These combined indicators are highly characteristic of a packed trojan designed to bypass initial security checks and execute its payload.
✗
The file is benign because static analysis found no indicators
Why it's wrong here
Concluding a file is benign solely because static analysis yields no indicators is a critical oversight in modern malware analysis. Sophisticated malware frequently employs packing, encryption, or obfuscation techniques specifically to hide malicious code and strings from static inspection. Dynamic analysis, which observes the file's behavior during execution, is essential to uncover the true nature of such evasive threats that static methods cannot detect.
✗
The file is a false positive and the sandbox environment is compromised
Why it's wrong here
Attributing observed malicious behaviors, such as establishing a network connection to a remote IP or performing process injection, to a false positive or a compromised sandbox environment is generally unwarranted without additional corroborating evidence. These actions are strong, direct indicators of malicious intent and typical malware functionality. A compromised sandbox would likely exhibit broader, more systemic anomalies rather than specific, targeted malicious file behaviors.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question