CHFI Malware Forensics 5

Question 1

A malware sample uses the Heaven's Gate technique on a 64-bit Windows system. What is the primary purpose of this technique?

Accepted Answer

Switching from 32-bit to 64-bit execution to bypass WOW64 API hooks

Answer

Heaven's Gate allows 32-bit malware running under WOW64 to directly invoke 64-bit code, bypassing 32-bit API hooks placed by security products in the WOW64 layer.

Question 2

Which Volatility 3 plugin would an investigator use to extract network connections (including those in CLOSE_WAIT and TIME_WAIT states) from a Windows memory image?

Accepted Answer

windows.netscan

Answer

windows.netscan scans memory pools for network structures and recovers connections in various TCP states including those that windows.netstat would miss.

Question 3

During malware triage, an analyst finds a PE file whose .text section has an entropy value of 7.8 out of 8. This MOST likely indicates:

Accepted Answer

The code section is packed or encrypted

Answer

Entropy near 8.0 in a PE code section indicates highly randomized data, which is characteristic of packing, encryption, or compression applied to hide the true payload.

Question 4

A forensic analyst is examining a macOS system suspected of running malware. Which location should be checked FIRST for user-level persistence launch agents?

Accepted Answer

~/Library/LaunchAgents/

Answer

~/Library/LaunchAgents/ stores per-user launch agents that run when the user logs in; malware without root access commonly places plist persistence files here.

Question 5

An investigator is analyzing a botnet C2 protocol and finds that the malware generates domain names using the current date as a seed for a pseudo-random algorithm. This is BEST described as:

Accepted Answer

Domain generation algorithm (DGA)

Answer

A Domain Generation Algorithm (DGA) uses a seed value such as the current date to algorithmically produce large numbers of potential C2 domain names, making takedowns difficult.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Malware Forensics 5