CHFI Malware Forensics Practice Question
A forensic investigator is examining a suspicious file and wants to determine its true file type regardless of its extension. The investigator runs the 'file' command on the file and receives the output 'PE32 executable (GUI) Intel 80386, for MS Windows'. However, the file has a .txt extension. What is the most likely explanation for this discrepancy?
⚠ Common exam trap
The trap here is trusting the file extension over the actual file content, which can lead to misclassification of malicious files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is a Windows executable that has been renamed with a .txt extension to evade detection or confuse users.
The 'file' command identifies file types by examining their content, particularly magic numbers. A PE32 executable header indicates a Windows executable, regardless of the file extension. Renaming an executable with a .txt extension is a common malware tactic to evade detection and trick users. The investigator should recognize this discrepancy as suspicious and handle the file accordingly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The file is a Windows executable that has been renamed with a .txt extension to evade detection or confuse users.
Why this is correct
Malware often uses misleading file extensions to disguise executables. The 'file' command correctly identifies the file as a PE32 executable based on its header, despite the .txt extension. This indicates deliberate renaming, a common tactic to bypass security controls that rely on extension-based filtering or to trick users into opening the file. The investigator should treat it as an executable.
- ✗
The file is a shortcut file (.lnk) that has been renamed to .txt, but the 'file' command misidentifies it as an executable.
Why it's wrong here
Shortcut files have a distinct structure and would not be identified as PE32 executables by the 'file' command. The 'file' command is reliable for distinguishing between .lnk and PE files. Misidentification is unlikely. Therefore, this option is incorrect; the file is more likely a true executable with a misleading extension.
- ✗
The file is a text file that has been mistakenly identified by the 'file' command due to its content.
Why it's wrong here
The 'file' command identifies file types based on magic numbers and content, not extension. If it reports PE32 executable, the file contains a valid PE header, which is not typical for a text file. A text file would be identified as ASCII text or similar, not as a PE executable. Thus, this option is incorrect.
- ✗
The file is a polyglot file that is both a valid text file and a valid executable.
Why it's wrong here
While polyglot files exist, the 'file' command output indicates a PE32 executable, not a polyglot. A polyglot might show multiple types or be identified as one type depending on the tool. The scenario does not suggest polyglot behavior; the most straightforward explanation is a renamed executable. Assuming polyglot without further evidence is speculative.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.