Ethical Hacking Malware Analysis 1 — Questions and Answers
Question 1: What is the primary difference between static and dynamic malware analysis?
- Static analysis runs the malware; dynamic analysis does not
- Static analysis examines code without execution; dynamic analysis observes malware behavior during execution (Correct answer)
- Static analysis uses virtual machines; dynamic analysis uses physical machines
- There is no difference — both involve executing the malware
Correct answer: Static analysis examines code without execution; dynamic analysis observes malware behavior during execution
Static analysis examines malware code, strings, and structure without executing it, while dynamic analysis runs the malware in a controlled environment to observe its runtime behavior.
Question 2: Which type of malware replicates itself by attaching its code to legitimate executable files?
- Trojan
- Worm
- Virus (Correct answer)
- Ransomware
Correct answer: Virus
A virus attaches itself to legitimate files and spreads when infected files are executed, requiring a host file to propagate unlike worms which self-replicate independently.
Question 3: What does a keylogger do?
- Encrypts files on the infected system
- Records keystrokes to capture passwords and sensitive input (Correct answer)
- Deletes files to cause data loss
- Creates a backdoor for remote access
Correct answer: Records keystrokes to capture passwords and sensitive input
A keylogger records all keystrokes made on an infected system, capturing passwords, credit card numbers, and other sensitive data typed by the victim.
Question 4: Which sandbox tool is widely used by penetration testers and malware analysts for automated dynamic malware analysis?
- IDA Pro
- Cuckoo Sandbox (Correct answer)
- Ghidra
- OllyDbg
Correct answer: Cuckoo Sandbox
Cuckoo Sandbox is an open-source automated malware analysis system that detonates suspicious files in an isolated VM and reports on file system changes, network activity, and API calls.
Question 5: What is 'packing' in the context of malware evasion?
- Bundling multiple malware payloads together
- Compressing or encrypting malware to hide its true code from antivirus detection (Correct answer)
- Adding junk code to increase file size
- Splitting malware across multiple files
Correct answer: Compressing or encrypting malware to hide its true code from antivirus detection
Packers compress or encrypt malware executables at rest, only unpacking the true payload in memory at runtime, making static signature detection ineffective.
Question 6: Which type of malware demands payment to restore access to encrypted files?
- Spyware
- Adware
- Ransomware (Correct answer)
- Rootkit
Correct answer: Ransomware
Ransomware encrypts victim files or locks systems and demands payment (typically cryptocurrency) for the decryption key to restore access.
Ethical Hacking Malware Analysis 1
What is the primary difference between static and dynamic malware analysis?