Unit 6: Analysis of Malware - Practice Quiz

1 What is malware?

2 Which characteristic is commonly associated with malware?

3 Which technique uses deceptive emails to convince users to open malicious links or attachments?

4 What is a drive-by download?

5 Why is a cryptographic hash calculated for a suspected malware file?

6 What should an investigator generally do before analyzing original malware evidence?

7 Which type of malware analysis examines a file without executing it?

8 Which type of malware analysis involves executing a sample in a controlled environment?

9 Which item can commonly be extracted from malware during basic static analysis?

10 What is a disassembler used for in static malware analysis?

11 Which feature in a suspicious Microsoft Word document may contain malicious instructions?

12 Which embedded feature should an analyst check in a suspicious PDF file?

13 What is the main purpose of a malware sandbox?

14 What does dynamic malware analysis primarily examine?

15 Which system property is commonly monitored for changes while malware is running?

16 Which activity may indicate suspicious malware behavior on a host system?

17 Which tool is commonly used to capture and inspect malware-related network packets?

18 Why might malware contact a command-and-control server?

19 Where does fileless malware primarily operate?

20 Which legitimate system tool is commonly abused in fileless malware attacks on Windows?

21 A utility performs its advertised backup function but secretly captures user credentials and sends them to an external server. Why should it be classified as malware?

22 A program disguises itself as an invoice viewer but installs a credential-stealing component when opened. Which malware category best describes its delivery method?

23 Employees receive realistic payment notices containing Word attachments that ask them to enable macros. Which spreading technique is being used?

24 An attacker compromises a website frequently visited by employees and adds code that attempts to exploit outdated browsers. What technique does this represent?

25 An investigator receives a suspicious executable from an infected workstation. What should be done before beginning analysis to support evidence integrity?

26 A live system may contain fileless malware, but shutting it down would erase memory contents. Which evidence should generally be collected first?

27 An analyst wants to identify readable strings, imported functions, and executable sections without running a suspicious file. Which type of analysis is most appropriate?

28 Static examination suggests that a sample is packed, so an analyst executes it in an isolated sandbox and then examines the unpacked memory image. What approach is being used?

29 A Windows executable imports VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which behavior do these imports most strongly suggest?

30 A suspicious executable has very high section entropy, few readable strings, and an unusually small import table. What is the most reasonable initial conclusion?

31 A Word document from an unknown sender displays instructions to enable macros. What is the safest initial analysis action?

32 A PDF contains both an /OpenAction entry and a /JavaScript object. Why is this combination especially suspicious?

33 Before executing malware in a virtual analysis environment, which preparation best supports reliable comparison and recovery?

34 A sample exits after detecting little mouse activity and a short system uptime. Which dynamic-analysis adjustment is most appropriate?

35 During monitoring, a process creates a value under a Windows Run registry key that points to its executable. What behavior is most likely being established?

36 A monitored process rapidly rewrites many user files, changes their extensions, and creates a payment note in each directory. Which behavior does this indicate?

37 A compromised host queries hundreds of algorithmically generated domain names, most of which return NXDOMAIN. What malware behavior is the best explanation?

38 A host sends small encrypted packets to the same external address every 60 seconds, even when no user is active. What does this pattern most strongly suggest?

39 A malicious macro starts PowerShell, downloads a script, and executes it directly in memory without saving an executable. Why is this considered a fileless attack?

40 An investigation finds a permanent WMI event subscription that launches an encoded PowerShell command whenever a user logs on. What role does the WMI subscription play?

41 A signed PowerShell script uses only legitimate administrative APIs, but it covertly disables endpoint protection and exfiltrates credentials. Which property most strongly supports classifying the script as malware?

42 Investigators find an unmodified credential-dumping utility on a penetration tester's workstation and on a compromised server. Why can its malware classification differ between the two systems?

43 A vendor's signed software updater is modified on its build server, and customers receive the malicious version through the normal update channel. Which spreading technique best describes this incident?

44 A phishing email contains an ISO image holding an LNK file that launches a hidden script. The ISO is used partly because extracted files may not retain the original email attachment's security-zone metadata. Which defense-evasion property is being exploited?

45 An active compromised host must be examined, and shutting it down would destroy memory-resident evidence. Assuming immediate network spread has been contained, which acquisition strategy best preserves the most volatile relevant evidence?

46 A suspected malware executable has creation and modification times predating the system installation, suggesting timestamp manipulation. Which method provides the strongest basis for reconstructing when it actually appeared?

47 Static examination shows that a sample is packed, while sandbox execution produces no behavior because the sample detects virtualization. Which next approach is most likely to expose its actual code while retaining analytical control?

48 An analyst must rapidly triage 5,000 samples while reserving manual reverse engineering for a small subset. Which workflow best balances scalability and analytical depth?

49 A PE sample resolves Windows APIs by hashing export names rather than storing readable imports. What is the most reliable static technique for identifying the intended APIs?

50 A PE section has entropy close to bits per byte, no readable strings, and executable permissions. Which conclusion is analytically justified?

51 A macro-free DOCX file contacts an attacker-controlled server when opened. Which OOXML artifact should be examined first for an external template injection attack?

52 A PDF scanner reports no JavaScript, but the viewer executes code when the document opens. The file contains multiple incremental updates. What should the analyst do next?

53 A sandbox accelerates long sleep calls, but malware compares several independent time sources and terminates when they diverge. Which countermeasure is most robust?

54 A sample starts a legitimate child process, injects code into it, and immediately exits. A sandbox monitors only the original process and reports no malicious activity. Which design change best addresses this blind spot?

55 A process appears to be hollowed: its executable path points to a legitimate program, but its behavior is unrelated. Which memory observation most strongly supports process hollowing?

56 During live monitoring, a persistence registry value is created and deleted within one second. Which evidence most directly attributes the change to the responsible process?

57 A host generates thousands of DNS queries for different high-entropy domains, and almost all responses are NXDOMAIN. Which interpretation is best supported?

58 Which DNS pattern most strongly distinguishes likely tunneling from a domain-generation algorithm?

59 An attacker establishes persistence using a permanent WMI event subscription that launches an in-memory PowerShell payload when a user logs on. Which set of WMI components enables this persistence?

60 A malicious document launches PowerShell, which retrieves encrypted code and loads it directly into memory without writing a conventional executable. Which statement about the incident is most accurate?