CHFI Malware Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Extract the ransom note and search for known ransomware identifiers such as Bitcoin wallet addresses or contact email.

  Why this is correct

  Ransom notes typically contain unique attribution artifacts—Bitcoin/cryptocurrency wallet addresses, victim IDs, Tor payment portal URLs, or contact emails—that can be cross-referenced against threat intelligence feeds (e.g., Abuse.ch, NoMoreRansom, or vendor reports) to pinpoint the exact ransomware family and, often, the specific variant and version. Extracting and parsing these identifiers is non-destructive, requires no special tooling, and gives the analyst a focused search target before investing time in malware dynamic analysis. This IOC-led approach is the fastest way to transition from an unknown incident to a known threat profile, enabling immediate acquisition of family-specific decryption tools, YARA rules, and network indicators.

• ✗

  Run the malware sample in a sandbox environment to observe its behavior.

  Why it's wrong here

  Sandboxing the malware sample is a valid later step, but as a first action it violates basic forensic triage because the ransomware binary may not have been properly recovered, isolated, or hashed from the evidence image; running an unvalidated sample risks accidental re-infection or incomplete behavioral capture due to sandbox evasion. The ransom note, by contrast, contains non-executable textual IOCs that immediately identify the family without needing to execute unknown code. Moreover, behavioral analysis should be performed on the actual sample extracted from the memory dump or disk image, not as a substitute for reading the victim's leave-behind note, and doing so prematurely could bypass the low-risk intelligence coup the note provides.

• ✗

  Perform static analysis of the encrypted files to determine the encryption algorithm used.

  Why it's wrong here

  Static analysis of encrypted files is largely an exercise in frustration because the ciphertext yields little to no useful information about the encryption algorithm or the key—most modern ransomware use hybrid cryptography (e.g., AES for bulk data and RSA or ECC for key wrapping), and without the private key or known plaintext, you cannot recover meaningful data or derive variant indicators from the file contents alone. The encrypted files' extensions or headers might hint at a family, but those are far less specific than the unique wallet addresses and contact data in the ransom note. The correct investigative step is to leverage the note's embedded identifiers to look up the known encryption scheme from public threat research, rather than attempting to reverse-engineer the algorithm from ciphertext.

• ✗

  Immediately disconnect the system from the network and power it off to preserve evidence.

  Why it's wrong here

  While disconnecting the network is a sound containment measure, immediately powering off the system is contraindicated because you have already captured a memory dump—the most volatile evidence—and a hard shutdown will destroy transitional data, such as encryption keys lingering in RAM, running process state, and open network connections, that could be crucial for decryption. A forensic analyst should perform orderly shutdown procedures only after all volatile evidence has been collected and after documenting the system state; halting the system first would also lose any ransomware artifacts still only in memory, including the in-memory malware code itself. Since the memory dump is already taken, the next logical step is not to power off but to examine easily accessible non-volatile artifacts like the ransom note to progress the investigation without evidence loss.

Go deeper

Related to this question