Back to Subject

Unit 6: Analysis of Malware - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 What is the primary definition of malware in the context of digital evidence analysis?

A. Hardware components that fail due to overheating
B. Network protocols used for secure communication
C. Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
D. Software designed to improve system performance

2 Which of the following is a common technique used by attackers to spread malware via email?

A. SQL Injection
B. Port Scanning
C. Packet Sniffing
D. Phishing

3 What is a 'Drive-by Download'?

A. Manually downloading a file from an email
B. Downloading software from a physical drive
C. Copying files from a USB stick
D. Unintended download of malicious code by visiting a compromised website

4 Which term describes malicious advertisements used to distribute malware?

A. Malvertising
B. Spyware
C. Adware
D. Ransomware

5 What is the primary goal of Malware Forensics?

A. To increase network speed
B. To understand the capabilities, origin, and impact of a malicious sample
C. To repair broken hardware
D. To design new antivirus software

6 Which analysis type involves examining the malware without executing it?

A. Memory Forensics
B. Dynamic Analysis
C. Behavioral Analysis
D. Static Analysis

7 Which environment is most recommended for performing malware analysis to prevent infection of the host system?

A. A public Wi-Fi network
B. The analyst's personal laptop
C. An isolated Virtual Machine (VM) or Sandbox
D. Production Server

8 In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?

A. To execute the file safely
B. To compress the file size
C. To decrypt the file
D. To identify the file uniquely and check against databases like VirusTotal

9 What tool is commonly used in static analysis to extract readable text strings from a binary?

A. Strings
B. Wireshark
C. Process Monitor
D. Fiddler

10 What does 'packing' refer to in the context of malware?

A. Zipping a file for email
B. Adding more features to the malware
C. Compressing or encrypting the executable to hide its code and evade detection
D. Bundling malware with legitimate software

11 Which file format is the standard executable format for Windows, often analyzed during malware forensics?

A. PE (Portable Executable)
B. APK
C. ELF
D. Mach-O

12 When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?

A. JavaScript
B. Image resolution
C. Text formatting
D. Page margins

13 What is a common indicator of a malicious Microsoft Word document?

A. The file size being under 1MB
B. The presence of VBA Macros (Visual Basic for Applications)
C. The use of Arial font
D. The document having a .docx extension

14 Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?

A. Nmap
B. Burp Suite
C. Oledump.py
D. Metasploit

15 What is 'Dynamic Malware Analysis'?

A. Scanning the file with an antivirus
B. Reading the source code
C. Checking the file creation date
D. Running the malware in a controlled environment to observe its behavior

16 Which of the following is a risk associated with Dynamic Analysis?

A. The malware might detect the virtual environment and stop running
B. It cannot identify network traffic
C. It requires access to the source code
D. It is only useful for text files

17 What is the function of a 'snapshot' in a virtual machine during malware analysis?

A. To print the code
B. To record the network traffic
C. To save the state of the VM so it can be reverted after infection
D. To take a picture of the malware author

18 Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?

A. Putty
B. Process Monitor (ProcMon)
C. VLC
D. FileZilla

19 In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?

A. The browser is clearing cache
B. The system is updating
C. The malware is establishing persistence to run on startup
D. The screen resolution is changing

20 What is 'Process Injection'?

A. Monitoring a process for errors
B. Stopping a process efficiently
C. Installing a new process via CD
D. Code belonging to one process being written into the address space of another process

21 What is a 'Mutex' (Mutual Exclusion) object often used for by malware?

A. To encrypt user files
B. To delete system logs
C. To ensure only one instance of the malware runs at a time
D. To connect to the internet

22 Which network behavior is characteristic of C2 (Command and Control) communication?

A. High bandwidth video streaming
B. Local printing traffic
C. Periodic 'beaconing' signals to an external server
D. Windows Update downloads

23 What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?

A. To simulate internet services (DNS, HTTP) so malware thinks it is online
B. To hack into the malware author's computer
C. To increase internet speed
D. To block all network traffic permanently

24 What is a Fileless Malware attack?

A. Malware that only targets empty files
B. Malware that deletes all files on a drive
C. Malware that exists primarily in memory without writing an executable file to the disk
D. Malware transmitted via paper

25 Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?

A. Shareware
B. LOLBins (Living off the Land Binaries)
C. Firmware
D. Bloatware

26 Which of the following is a common entry point for fileless malware?

A. Installing a fresh OS
B. Connecting a printer
C. A physical CD-ROM
D. Exploit kits targeting browser vulnerabilities

27 What is the role of WMI (Windows Management Instrumentation) in fileless attacks?

A. It can be used to execute scripts and maintain persistence without files
B. It manages the mouse pointer
C. It acts as a firewall
D. It is used for graphics rendering

28 How does Domain Generation Algorithm (DGA) help malware?

A. It generates random domain names to rendezvous with the C2 server, evading blacklists
B. It encrypts the hard drive
C. It generates strong passwords for the user
D. It speeds up the infection process

29 Which tool is best suited for capturing and analyzing network packets during malware analysis?

A. Resource Hacker
B. RegEdit
C. Notepad++
D. Wireshark

30 What is 'import hashing' (Imphash)?

A. Hashing the list of imported functions to identify related malware samples
B. Hashing the file name
C. Hashing the user's password
D. Hashing the network traffic

31 What is a 'Trojan Horse'?

A. Hardware used to steal data
B. Malware disguised as legitimate software to mislead users of its true intent
C. Self-replicating malware
D. Malware that locks the screen

32 Which component of the PE header contains information about the compilation time of the malware?

A. Subsystem
B. Time Date Stamp
C. Machine Type
D. Pointer to Symbol Table

33 What does the term 'Obfuscation' mean in malware analysis?

A. Translating the code to English
B. Making the code difficult for humans and analysis tools to understand
C. Highlighting important code sections
D. Deleting the code

34 In the context of PDF analysis, what is a '/OpenAction'?

A. A command to close the file
B. A permission setting
C. A font style
D. A command that specifies an action to perform immediately upon opening the document

35 What is 'Sandboxing'?

A. Encrypting a hard drive
B. Cleaning the computer case
C. Automated dynamic analysis in a secure environment
D. Playing a game

36 Which of the following is a symptom of Ransomware?

A. Files are encrypted and a payment note is displayed
B. The web browser opens multiple tabs
C. The mouse moves slowly
D. The computer shuts down randomly

37 What is the primary difference between a Virus and a Worm?

A. Viruses are hardware-based
B. Viruses encrypt files; Worms delete them
C. Worms are only for Linux
D. Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically

38 Why might an analyst check 'Imported Functions' (Imports) in the PE header?

A. To see the icon
B. To check the author's name
C. To guess what the malware is capable of (e.g., networking, file manipulation)
D. To see the file size

39 What does 'Shellcode' refer to in a malicious document?

A. The name of the file
B. The visual layout of the document
C. Machine code payload used to exploit a vulnerability
D. The password protection

40 Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?

A. Calculator
B. TCPView
C. Notepad
D. Paint

41 What is 'DLL Injection'?

A. Scanning DLLs for viruses
B. Removing a DLL file
C. Forcing a process to load a malicious Dynamic Link Library (DLL)
D. Renaming a DLL file

42 What is the 'AutoOpen' macro in Word?

A. A macro that prints the file
B. A macro that runs automatically when a document is opened
C. A macro that saves the file
D. A macro that changes the font

43 How can fileless malware persist using the Windows Registry?

A. By storing malicious scripts in registry keys and invoking them via PowerShell
B. By disabling the mouse
C. By deleting the registry
D. By changing the desktop background

44 Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?

A. ARP
B. DNS (Domain Name System)
C. ICMP
D. DHCP

45 What is the purpose of 'API Hooking' in malware?

A. To organize files
B. To speed up the internet
C. To fix bugs in Windows
D. To intercept function calls between the system and applications to modify or monitor behavior

46 Which section of a PE file typically contains the executable code?

A. .reloc
B. .data
C. .rsrc
D. .text

47 When analyzing a suspicious URL found in malware, what should an analyst do?

A. Email the URL to friends
B. Open it in their personal browser immediately
C. Ignore it
D. Investigate it using reputation services or a safe sandbox environment

48 What is the primary characteristic of a 'Rootkit'?

A. It displays ads
B. It spreads via USB
C. It is designed to hide the existence of certain processes or programs from normal detection methods
D. It encrypts files

49 What is 'Entropy' used for in static malware analysis?

A. To count the lines of code
B. To measure the file temperature
C. To measure the network speed
D. To measure the randomness of data, helping identify packed or encrypted code

50 Why is 'PowerShell' a frequent target for fileless malware?

A. It is not installed on most computers
B. It has deep access to the Windows API and system management functions without needing new binaries
C. It is a web browser
D. It is a game engine
Previous MCQ
Unit 5