Ethical Hacking Malware Analysis 2

Question 1

What is a 'rootkit' and why is it particularly dangerous?

Accepted Answer

Malware that hides its presence deep in the OS, often at the kernel level, making it very difficult to detect

Answer

Rootkits embed themselves at the OS or kernel level to conceal their presence and other malware, evading traditional antivirus tools and persisting even after system reboots.

Question 2

Which technique do malware analysts use to identify strings and metadata in a malware binary without execution?

Accepted Answer

String extraction and PE header analysis

Answer

String extraction reveals hardcoded URLs, IP addresses, and commands within malware, while PE header analysis exposes import tables, compilation timestamps, and packer signatures.

Question 3

What is a 'backdoor' malware?

Accepted Answer

Malware that provides persistent remote access to a compromised system

Answer

A backdoor creates a covert persistent entry point into a compromised system, allowing attackers to return at will without needing to re-exploit the initial vulnerability.

Question 4

Which tool is commonly used for reverse engineering malware binaries through disassembly?

Accepted Answer

Ghidra

Answer

Ghidra is a free, open-source reverse engineering tool developed by the NSA that disassembles and decompiles binary executables to analyze malware code structure.

Question 5

What is 'polymorphic malware'?

Accepted Answer

Malware that changes its code signature with each infection while keeping functionality intact

Answer

Polymorphic malware mutates its code signature with each infection cycle while preserving its core malicious functionality, evading signature-based antivirus detection.

Ethical Hacking Practice Test

Ethical Hacking Practice Test

Ethical Hacking Malware Analysis 2