CHFI Malware Forensics 5 — Questions and Answers
Question 1: A malware sample uses the Heaven's Gate technique on a 64-bit Windows system. What is the primary purpose of this technique?
- Switching from 32-bit to 64-bit execution to bypass WOW64 API hooks (Correct answer)
- Escalating privileges by abusing kernel call gates
- Encrypting code sections to evade signature detection
- Injecting code via 64-bit process from a 32-bit process
Correct answer: Switching from 32-bit to 64-bit execution to bypass WOW64 API hooks
Heaven's Gate allows 32-bit malware running under WOW64 to directly invoke 64-bit code, bypassing 32-bit API hooks placed by security products in the WOW64 layer.
Question 2: Which Volatility 3 plugin would an investigator use to extract network connections (including those in CLOSE_WAIT and TIME_WAIT states) from a Windows memory image?
- windows.netstat
- windows.netscan (Correct answer)
- windows.connections
- windows.sockets
Correct answer: windows.netscan
windows.netscan scans memory pools for network structures and recovers connections in various TCP states including those that windows.netstat would miss.
Question 3: During malware triage, an analyst finds a PE file whose .text section has an entropy value of 7.8 out of 8. This MOST likely indicates:
- The code section is packed or encrypted (Correct answer)
- The file is a legitimate compiled binary
- The binary is a debug build with symbol tables
- The executable uses heavy compiler optimizations
Correct answer: The code section is packed or encrypted
Entropy near 8.0 in a PE code section indicates highly randomized data, which is characteristic of packing, encryption, or compression applied to hide the true payload.
Question 4: A forensic analyst is examining a macOS system suspected of running malware. Which location should be checked FIRST for user-level persistence launch agents?
- ~/Library/LaunchAgents/ (Correct answer)
- /System/Library/LaunchDaemons/
- /Library/LaunchDaemons/
- /etc/cron.d/
Correct answer: ~/Library/LaunchAgents/
~/Library/LaunchAgents/ stores per-user launch agents that run when the user logs in; malware without root access commonly places plist persistence files here.
Question 5: An investigator is analyzing a botnet C2 protocol and finds that the malware generates domain names using the current date as a seed for a pseudo-random algorithm. This is BEST described as:
- Domain generation algorithm (DGA) (Correct answer)
- Fast-flux DNS
- DNS sinkholeability evasion
- Bullet-proof hosting
Correct answer: Domain generation algorithm (DGA)
A Domain Generation Algorithm (DGA) uses a seed value such as the current date to algorithmically produce large numbers of potential C2 domain names, making takedowns difficult.
Question 6: A CHFI investigator recovers a file from a Linux system that has been deleted but whose inode has not yet been reallocated. Which command can recover the file content using its inode number?
- debugfs -R 'cat <inode>' /dev/sdX (Correct answer)
- fsck -r <inode> /dev/sdX
- extundelete --restore-inode <inode> /dev/sdX
- grep -a <inode> /dev/sdX
Correct answer: debugfs -R 'cat <inode>' /dev/sdX
debugfs is an ext2/3/4 filesystem debugger that can read data blocks associated with a specific inode, enabling direct recovery of deleted file content.
Question 7: During malware analysis, you find that a sample uses atom bombing — writing shellcode to the global atom table and using callback functions to execute it. Which Windows mechanism does this abuse?
- NtQueueApcThread with GlobalAddAtom for code injection without WriteProcessMemory (Correct answer)
- COM object hijacking via the global atom table
- AppInit_DLLs loading through atom table entries
- Kernel callback table manipulation using atoms
Correct answer: NtQueueApcThread with GlobalAddAtom for code injection without WriteProcessMemory
Atom bombing injects code by writing shellcode into the global atom table and using NtQueueApcThread to queue an APC that copies and executes the atom data in the target process without calling WriteProcessMemory.
CHFI Malware Forensics 5
A malware sample uses the Heaven's Gate technique on a 64-bit Windows system.
What is the primary purpose of this technique?