CHFI Malware Forensics 4

Question 1

A wiper malware overwrites the first 512 bytes of every connected drive. What critical structure is it targeting?

Accepted Answer

Master Boot Record (MBR)

Answer

The Master Boot Record occupies the first 512 bytes of a disk and contains the bootloader code and partition table; overwriting it renders the system unbootable.

Question 2

A forensic analyst discovers that malware is using DNS TXT records to receive commands. This is an example of which C2 technique?

Accepted Answer

DNS tunneling for command-and-control

Answer

DNS tunneling encodes C2 commands and data within DNS query/response fields such as TXT records, allowing covert communication that often bypasses firewall rules permitting DNS traffic.

Question 3

During memory forensics with Volatility, which plugin would BEST detect a userland rootkit that has unlinked a process from the EPROCESS doubly linked list?

Accepted Answer

psscan

Answer

psscan scans raw memory pools for EPROCESS structures rather than walking the linked list, so it finds processes hidden by DKOM that have been unlinked from the list.

Question 4

A malware sample achieves persistence by adding an entry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run using a living-off-the-land binary. Which binary would be LEAST expected in this context?

Accepted Answer

taskmgr.exe

Answer

taskmgr.exe is the Task Manager and is not a LOLBin commonly abused for script execution or payload loading; regsvr32, mshta, and wscript are classic LOLBins used for persistence.

Question 5

A mobile malware sample on Android requests the READ_SMS and SEND_SMS permissions. From a forensic perspective, which threat category does this MOST indicate?

Accepted Answer

Banking trojan intercepting OTP SMS codes

Answer

Banking trojans commonly abuse SMS permissions to intercept one-time passwords sent by banks for two-factor authentication, forwarding them to the attacker.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Malware Forensics 4