CHFI Mobile and Malware Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Strings

  Why it's wrong here

  The `strings` utility (or Sysinternals Strings) scans a binary for ASCII/Unicode character sequences, making it useful for spotting embedded filenames, URLs, or registry keys, but it performs no structural parsing of the PE format. It cannot reveal header fields such as the `IMAGE_FILE_HEADER` machine type, section table, or data directory entries, nor does it detect packers or compilers. Therefore, it is the wrong tool for examining PE header details in a malware sample.

• ✗

  Ghidra

  Why it's wrong here

  Ghidra is a reverse engineering framework developed by the NSA that focuses on disassembly, decompilation, and project-based analysis with a heavy emphasis on program behavior. While it can display PE header structures through its listing and data type manager, its primary workflow is to understand and reverse-engineer code, not to perform a quick, targeted inspection of the PE header or to detect packers and protectors. Using Ghidra for header inspection is akin to using a full decompiler to read a file timestamp; it parses headers internally but does not present them as a packer/header forensic analysis tool.

• ✗

  IDA Pro

  Why it's wrong here

  IDA Pro is a professional disassembler and decompiler designed for static code analysis, and it does parse PE headers to resolve sections, imports, and the entry point for its listing. However, its output is centered on the disassembly listing, control flow graphs, and decompiled pseudocode, not on a dedicated PE header inspection view. Most critically, IDA Pro lacks the packer signature database and one-click heuristic scanning that PEiD offers, so it is not the appropriate choice for identifying whether a malware sample is packed with UPX, Themida, ASProtect, or another protector.

• ✓

  PEiD

  Why this is correct

  PEiD (Portable Executable Identifier) is a specialized forensic and reverse-engineering tool that statically parses PE files to identify the compiler, linker, and—most importantly—the packer or protector used. It extracts and displays PE header details such as the entry point, the section table with names and sizes, and optional header fields, then cross-references them against a signature database of known packers (e.g., UPX, ASPack, Themida) using byte patterns and section heuristics. For a malware analyst performing triage, PEiD instantly reveals whether a binary is packed and which tool packed it, making it the correct choice for PE header and packer analysis.

Go deeper

Related to this question