CHFI Malware Forensics Practice Question
You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?
⚠ Common exam trap
The CHFI exam often tests the misconception that static analysis is always sufficient to determine maliciousness, but the trap here is that malware can be conditionally dormant and only activate when network connectivity is present, making dynamic analysis with network simulation essential.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a thorough static analysis using a disassembler and debugger to understand the code
Why it's wrong here
Static analysis with a disassembler and debugger is foundational for revealing code structure, but it cannot capture behaviors that manifest only under specific runtime conditions, such as a live command-and-control (C2) channel. Malware often employs anti-analysis techniques like packing, obfuscation, and anti-debugging, or it may deliberately wait for network responses before executing its payload. Debugging can also alter timing and trigger defensive routines, so static analysis alone is insufficient to observe the full attack sequence, especially network-dependent activity.
- ✗
Delete the suspicious file and run a full antivirus scan on the system
Why it's wrong here
Deleting the suspicious file destroys probative evidence and undermines forensic integrity, while a full antivirus scan relies primarily on signature-based detection that is ineffective against unknown, polymorphic, or fileless malware. Even if the scan flags the file, it does not reveal the malware's behavior, C2 infrastructure, or impact. Proper procedure requires preserving the original sample through forensic imaging, then performing dynamic analysis in a controlled environment to understand the threat, not summarily deleting it.
- ✓
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Why this is correct
Re-running the sample in a sandbox with simulated network connectivity or a controlled network is the correct approach because many malware families remain dormant until they establish C2 communication, at which point they download additional payloads, exfiltrate data, or execute commands. A network-enabled sandbox provides a safe, but realistic environment where the analyst can observe DNS queries, HTTP/S connections, beaconing intervals, and the exact data exchanged with the C2 server. This dynamic analysis yields actionable indicators of compromise (IoCs) and reveals the malware's full functionality without risking real network infection.
- ✗
Perform a forensic imaging of the system again and compare with the original image
Why it's wrong here
Performing a forensic imaging of the system again and comparing it with the original image will only show file-system changes, such as new files or altered timestamps, but it cannot reveal the malware's runtime behavior or the content of its C2 communications. Re-imaging is a preservation and evidence-integrity process, not an analytical technique for inducing or observing malicious actions. To understand the sample's network activity and payload, one must perform dynamic analysis in a sandboxed environment with controlled connectivity, not repeat forensic imaging.
Visual reference
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.