CHFI Mobile and Malware Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the file as it is likely a false positive from a legitimate UPX-packed application.

  Why it's wrong here

  Deleting the file is an egregious evidence-handling error: UPX packing is a legitimate compression technique used by many benign executables, but it is also a common evasion tactic in malware. The investigator cannot distinguish a false positive from a real threat without unpacking and inspecting the binary's actual code, imports, and strings. Destroying the sample would break chain of custody, destroy potential evidence, and irrevocably prevent analysis. The proper forensic response is to preserve the file and perform a technical examination, not to discard it based on an unverified assumption.

• ✓

  Unpack the file using the UPX tool or manual unpacking to obtain the original executable.

  Why this is correct

  Unpacking is the correct next step because UPX is a reversible packer: the `upx -d` command can usually reconstruct the original executable, exposing the real code, import table, and resources for static analysis. Even if the UPX header is intentionally malformed or modified to resist automatic unpacking, a manual unpacking approach—using memory dumps, Scylla or ImpRec for import reconstruction—can recover the original logic. Analyzing the unpacked binary allows the investigator to identify malicious behavior without executing it, which is critical for understanding the threat and preserving integrity. This approach directly addresses the core investigative need to analyze the true payload, not just the packing stub.

• ✗

  Submit the packed file to VirusTotal to obtain a hash-based detection report.

  Why it's wrong here

  VirusTotal is a useful triage resource, but it is not a substitute for unpacking and does not reveal the original executable. The service primarily matches known hashes and signatures against its database; a packed malware sample may yield a generic detection or even a false negative if it is a zero-day sample. Furthermore, the file's hash changes after unpacking, so VirusTotal's report is only relevant to the packed form and provides no insight into the actual code or behavior. Unpacking first and then submitting the unpacked binary (if needed) is the more rigorous forensic methodology.

• ✗

  Run the file in a sandbox without unpacking to observe dynamic behavior.

  Why it's wrong here

  Running the packed file in a sandbox without unpacking will only expose the behavior of the UPX stub and any runtime unpacking routine, not the intentions of the underlying malware. The original code is decompressed only in memory after the stub executes, so dynamic analysis of the packed file without dumping the unpacked process memory misses the full instruction stream, possibly allowing malicious payloads to hide until specific conditions are met. Additionally, executing a sample always carries risk, even in a sandbox, and should not precede static analysis of the recovered original code. Unpacking is the forensic standard because it enables a systematic static analysis before any dynamic execution, reducing surprises and providing context for the observed behavior.

Go deeper

Related to this question