CHFI Malware Forensics 3

Question 1

A malware sample is found to create a service with a binary path pointing to a UNC path (\server\share\evil.exe). What persistence mechanism does this represent?

Accepted Answer

Remote service execution for lateral movement

Answer

Malware can create Windows services with UNC paths so that the payload is loaded from an attacker-controlled network share, enabling both persistence and lateral movement.

Question 2

During static analysis of a PE file, you find that the import table contains only LoadLibrary and GetProcAddress. What does this suggest?

Accepted Answer

The malware dynamically resolves all API calls at runtime to evade static detection

Answer

Using only LoadLibrary and GetProcAddress allows malware to resolve all needed APIs at runtime, making static import analysis ineffective for determining capabilities.

Question 3

A forensic examiner finds evidence of a malware using named pipes for inter-process communication. Which Windows Sysinternals tool would BEST enumerate active named pipes?

Accepted Answer

PipeList

Answer

PipeList from Sysinternals enumerates all named pipes on a Windows system, making it ideal for identifying malicious IPC channels used by malware.

Question 4

A banking trojan hooks the browser's SSL functions to capture plaintext credentials before encryption. What technique is this?

Accepted Answer

Man-in-the-browser (MitB) attack

Answer

MitB malware injects into the browser process and hooks SSL/TLS functions or form submission handlers to steal credentials before they are encrypted.

Question 5

Which tool would a CHFI investigator use to detect anti-forensic timestomping performed by malware on a Windows NTFS system?

Accepted Answer

Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT

Answer

Timestomping modifies $STANDARD_INFORMATION timestamps but often leaves $FILE_NAME timestamps untouched, so comparing both MFT attributes reveals manipulation.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Malware Forensics 3