CHFI - Computer Hacking Forensic Investigator Malware Forensics Questions and Answers — Questions and Answers
Question 1: A malware analyst is performing static analysis on a suspicious executable. The analyst notes that the file has a very small import address table (IAT) but a section with unusually high entropy. What is the most likely reason for these characteristics?
- The file is a benign utility with minimal dependencies.
- The executable is corrupted and missing its header information.
- The malware is packed or encrypted to obfuscate its true code. (Correct answer)
- The file is a script-based malware, such as a PowerShell script.
Correct answer: The malware is packed or encrypted to obfuscate its true code.
Packers compress or encrypt a malware's original code. The resulting binary has a small unpacking 'stub' with few imports, which is responsible for decompressing/decrypting the real malicious code in memory. The packed section itself appears random, leading to high entropy, which is a classic indicator of this obfuscation technique.
Question 2: A CHFI is conducting dynamic analysis of a suspected ransomware sample in an isolated, sandboxed environment. Which of the following actions would be the primary focus of the analyst's monitoring to confirm the malware's classification and behavior?
- Observing rapid and widespread file read/write/rename operations, especially with a new file extension being added. (Correct answer)
- Analyzing the PE header of the file to determine the compile time and linked libraries.
- Extracting all embedded strings from the binary to look for keywords like 'encrypt'.
- Checking for an increase in CPU usage and memory consumption by the suspicious process.
Correct answer: Observing rapid and widespread file read/write/rename operations, especially with a new file extension being added.
Dynamic analysis focuses on observing the malware's behavior at runtime. The defining characteristic of ransomware is its encryption of user files. Therefore, monitoring for high-volume file system I/O, particularly operations that involve reading original files and writing newly encrypted versions (often with a specific extension), is the most direct way to observe and confirm its malicious intent.
Question 3: An investigator is analyzing a compromised Windows machine and needs to determine how a piece of malware achieves persistence across reboots. Which of the following is one of the most common registry keys an analyst should examine for malicious entries?
- HKEY_CLASSES_ROOT\.dll
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (Correct answer)
- HKEY_USERS\.DEFAULT\Keyboard Layout
Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
The `HKLM\SYSTEM\CurrentControlSet\Services` registry key is a fundamental location where Windows services are defined. Malware frequently creates a new service pointing to its executable to ensure it is launched automatically by the operating system at startup, often with high privileges. While other locations can be used for persistence, this is a primary and critical location to investigate.
Question 4: During a memory forensics analysis using a tool like Volatility, an investigator lists all running processes from a memory dump. The output shows a suspicious process named `svc-host.exe`, which is a common misspelling of the legitimate `svchost.exe`. This finding is an example of which malware analysis technique?
- Code signing verification
- Masquerading (Correct answer)
- File carving
- Steganography
Correct answer: Masquerading
Masquerading is a technique where malware disguises itself by using a name that is very similar to a legitimate system file or process. The goal is to deceive system administrators or investigators who are performing a quick review, causing them to overlook the malicious process.
Question 5: A forensic analyst suspects a system is infected with a sophisticated kernel-mode rootkit. The analyst runs `tasklist` on the live system and sees no malicious processes. However, after acquiring a memory dump and analyzing it with Volatility, a hidden process is discovered. This discrepancy is most likely caused by the rootkit performing what action?
- Encrypting its own process memory.
- Deleting the process executable from the disk after loading.
- Using Direct Kernel Object Manipulation (DKOM) to unlink its process from the active process list. (Correct answer)
- Injecting its code into a legitimate process like `explorer.exe`.
Correct answer: Using Direct Kernel Object Manipulation (DKOM) to unlink its process from the active process list.
Kernel-mode rootkits can directly manipulate the kernel's data structures. By using DKOM, a rootkit can remove the `EPROCESS` block of its process from the doubly-linked list of active processes that the kernel maintains. User-mode tools that rely on standard APIs to list processes will not see the malware, but memory forensics tools that parse these raw kernel structures directly can still find the unlinked process.
Question 6: Which of the following best describes the primary goal of performing reverse engineering on a malware sample during a forensic investigation?
- To create a valid cryptographic hash of the malicious file for an IOC database.
- To safely execute the malware in a sandbox to observe its network traffic.
- To determine the date and time the malware was compiled by the author.
- To understand the malware's precise functionality, algorithms, and capabilities by analyzing its disassembled code. (Correct answer)
Correct answer: To understand the malware's precise functionality, algorithms, and capabilities by analyzing its disassembled code.
Reverse engineering involves disassembling or decompiling a binary to analyze its assembly code. The ultimate goal is to understand exactly what the program does, how its algorithms work (e.g., encryption routines, C2 communication protocols), and what its full capabilities are. This provides a much deeper understanding than static or dynamic analysis alone.
CHFI - Computer Hacking Forensic Investigator Malware Forensics Questions and Answers
A malware analyst is performing static analysis on a suspicious executable.
The analyst notes that the file has a very small import address table (IAT) but a section with unusually high entropy.
What is the most likely reason for these characteristics?