CHFI Mobile and Malware Forensics Practice Question
An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?
⚠ Common exam trap
EC-Council often tests the distinction between obfuscation (e.g., XOR encryption) and packing (e.g., UPX compression), where candidates mistakenly equate any encryption with a packer, but a packer specifically alters the PE structure and includes a decompression stub, while XOR obfuscation is a simpler, non-structural transformation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Timestomping and obfuscation
Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Timestomping and obfuscation
Why this is correct
Timestomping is the deliberate modification of file system timestamps (MAC times) to disrupt forensic timeline reconstruction and hide when malware was deployed or accessed. The presence of XOR-encoded strings constitutes obfuscation, a common evasion method used to complicate static signature detection and reverse engineering. Together, these artifacts indicate a deliberate anti-forensic effort to hinder incident response analysis.
- ✗
Packer and anti-debugging
Why it's wrong here
Packing wraps an executable in a compressed or encrypted layer to evade signature detection, while anti-debugging involves explicit checks like IsDebuggerPresent, NtQueryInformationProcess, or timing traps. The evidence only shows XOR-based encoding, which is a simple encryption operation, not a full packer or any defensive anti-analysis mechanism designed to impede dynamic analysis. No debugger detection or self-modifying unpacker stubs were reported, so this option overstates the available evidence.
- ✗
Rootkit installation and process hiding
Why it's wrong here
Rootkits operate by hooking kernel APIs, manipulating SSDT, or using DKOM to hide processes, files, and registry keys from the operating system. No such kernel-level manipulations, hidden objects, or suspicious device drivers were observed in the compromised system. XOR obfuscation of data does not indicate process hiding, and without evidence of stealth APIs or hidden process listings, this attribution is unsupported.
- ✗
Log wiping and data hiding
Why it's wrong here
Log wiping typically involves clearing, rotating, or altering event and security logs, often via commands like `wevtutil cl` or deleting evidence in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog`, and no such changes or disabled auditing were reported. Data hiding commonly uses NTFS alternate data streams, steganography, or covert channels to conceal data location, whereas XOR encryption obscures the content's readability, not its existence. Since neither log tampering nor covert storage artifacts were found, this option mischaracterizes the observed anti-forensic techniques.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.