CHFI Malware Forensics 4 — Questions and Answers
Question 1: A wiper malware overwrites the first 512 bytes of every connected drive. What critical structure is it targeting?
- Master Boot Record (MBR) (Correct answer)
- GUID Partition Table (GPT) header
- Volume Boot Record (VBR)
- NTFS $Boot file
Correct answer: Master Boot Record (MBR)
The Master Boot Record occupies the first 512 bytes of a disk and contains the bootloader code and partition table; overwriting it renders the system unbootable.
Question 2: A forensic analyst discovers that malware is using DNS TXT records to receive commands. This is an example of which C2 technique?
- DNS tunneling for command-and-control (Correct answer)
- Domain generation algorithm (DGA)
- Fast-flux DNS evasion
- DNS cache poisoning
Correct answer: DNS tunneling for command-and-control
DNS tunneling encodes C2 commands and data within DNS query/response fields such as TXT records, allowing covert communication that often bypasses firewall rules permitting DNS traffic.
Question 3: During memory forensics with Volatility, which plugin would BEST detect a userland rootkit that has unlinked a process from the EPROCESS doubly linked list?
- psscan (Correct answer)
- pslist
- dlllist
- cmdline
Correct answer: psscan
psscan scans raw memory pools for EPROCESS structures rather than walking the linked list, so it finds processes hidden by DKOM that have been unlinked from the list.
Question 4: A malware sample achieves persistence by adding an entry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run using a living-off-the-land binary. Which binary would be LEAST expected in this context?
- regsvr32.exe
- mshta.exe
- wscript.exe
- taskmgr.exe (Correct answer)
Correct answer: taskmgr.exe
taskmgr.exe is the Task Manager and is not a LOLBin commonly abused for script execution or payload loading; regsvr32, mshta, and wscript are classic LOLBins used for persistence.
Question 5: A mobile malware sample on Android requests the READ_SMS and SEND_SMS permissions. From a forensic perspective, which threat category does this MOST indicate?
- Banking trojan intercepting OTP SMS codes (Correct answer)
- Ransomware seeking contact exfiltration
- Spyware recording microphone audio
- Adware generating click fraud revenue
Correct answer: Banking trojan intercepting OTP SMS codes
Banking trojans commonly abuse SMS permissions to intercept one-time passwords sent by banks for two-factor authentication, forwarding them to the attacker.
Question 6: An investigator finds a suspicious DLL in C:\Windows\System32 that is loaded by svchost.exe but does not appear in any Microsoft catalog. The BEST first step to assess this DLL is to:
- Submit its SHA-256 hash to VirusTotal and check its digital signature (Correct answer)
- Delete it immediately and restart the service
- Run strings against it and review the output
- Check the DLL against the Prefetch execution record
Correct answer: Submit its SHA-256 hash to VirusTotal and check its digital signature
Checking the hash against VirusTotal and verifying the code-signing certificate are non-destructive, rapid triage steps that establish whether the DLL is known malicious before deeper analysis.
Question 7: A forensic image of a compromised host shows that the malware modified the hosts file to redirect antivirus update domains to 127.0.0.1. What is the forensic artifact path for the Windows hosts file?
- C:\Windows\System32\drivers\etc\hosts (Correct answer)
- C:\Windows\System32\etc\hosts
- C:\Windows\SysWOW64\drivers\hosts
- C:\ProgramData\Microsoft\Windows\hosts
Correct answer: C:\Windows\System32\drivers\etc\hosts
The Windows hosts file is located at C:\Windows\System32\drivers\etc\hosts and is a common target for malware to block security tool updates by overriding DNS resolution.
CHFI Malware Forensics 4
A wiper malware overwrites the first 512 bytes of every connected drive.
What critical structure is it targeting?