Ethical Hacking Malware Analysis 2 — Questions and Answers
Question 1: What is a 'rootkit' and why is it particularly dangerous?
- Malware that encrypts files for ransom
- Malware that hides its presence deep in the OS, often at the kernel level, making it very difficult to detect (Correct answer)
- A virus that spreads through network shares
- Adware that displays unwanted advertisements
Correct answer: Malware that hides its presence deep in the OS, often at the kernel level, making it very difficult to detect
Rootkits embed themselves at the OS or kernel level to conceal their presence and other malware, evading traditional antivirus tools and persisting even after system reboots.
Question 2: Which technique do malware analysts use to identify strings and metadata in a malware binary without execution?
- Behavioral analysis
- Dynamic analysis
- String extraction and PE header analysis (Correct answer)
- Network traffic analysis
Correct answer: String extraction and PE header analysis
String extraction reveals hardcoded URLs, IP addresses, and commands within malware, while PE header analysis exposes import tables, compilation timestamps, and packer signatures.
Question 3: What is a 'backdoor' malware?
- Malware that installs itself in the system boot sector
- Malware that provides persistent remote access to a compromised system (Correct answer)
- Malware that spreads via USB drives
- Malware that deletes files after a set time
Correct answer: Malware that provides persistent remote access to a compromised system
A backdoor creates a covert persistent entry point into a compromised system, allowing attackers to return at will without needing to re-exploit the initial vulnerability.
Question 4: Which tool is commonly used for reverse engineering malware binaries through disassembly?
- Nmap
- Wireshark
- Ghidra (Correct answer)
- Metasploit
Correct answer: Ghidra
Ghidra is a free, open-source reverse engineering tool developed by the NSA that disassembles and decompiles binary executables to analyze malware code structure.
Question 5: What is 'polymorphic malware'?
- Malware that targets multiple operating systems
- Malware that changes its code signature with each infection while keeping functionality intact (Correct answer)
- Malware controlled by multiple C2 servers
- Malware that spreads through multiple infection vectors
Correct answer: Malware that changes its code signature with each infection while keeping functionality intact
Polymorphic malware mutates its code signature with each infection cycle while preserving its core malicious functionality, evading signature-based antivirus detection.
Question 6: Which type of malware disguises itself as legitimate software to trick users into installation?
- Worm
- Virus
- Trojan (Correct answer)
- Adware
Correct answer: Trojan
A Trojan horse (Trojan) masquerades as legitimate or desirable software to trick users into installing it, then performs malicious actions once executed.
Ethical Hacking Malware Analysis 2
What is a 'rootkit' and why is it particularly dangerous?