Back to Subject

Unit 6: Analysis of Malware - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 What is the primary definition of malware in the context of digital evidence analysis?

A. Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
B. Hardware components that fail due to overheating
C. Network protocols used for secure communication
D. Software designed to improve system performance

2 Which of the following is a common technique used by attackers to spread malware via email?

A. SQL Injection
B. Port Scanning
C. Packet Sniffing
D. Phishing

3 What is a 'Drive-by Download'?

A. Copying files from a USB stick
B. Manually downloading a file from an email
C. Unintended download of malicious code by visiting a compromised website
D. Downloading software from a physical drive

4 Which term describes malicious advertisements used to distribute malware?

A. Malvertising
B. Ransomware
C. Spyware
D. Adware

5 What is the primary goal of Malware Forensics?

A. To repair broken hardware
B. To understand the capabilities, origin, and impact of a malicious sample
C. To increase network speed
D. To design new antivirus software

6 Which analysis type involves examining the malware without executing it?

A. Static Analysis
B. Behavioral Analysis
C. Dynamic Analysis
D. Memory Forensics

7 Which environment is most recommended for performing malware analysis to prevent infection of the host system?

A. Production Server
B. The analyst's personal laptop
C. A public Wi-Fi network
D. An isolated Virtual Machine (VM) or Sandbox

8 In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?

A. To compress the file size
B. To identify the file uniquely and check against databases like VirusTotal
C. To decrypt the file
D. To execute the file safely

9 What tool is commonly used in static analysis to extract readable text strings from a binary?

A. Process Monitor
B. Fiddler
C. Wireshark
D. Strings

10 What does 'packing' refer to in the context of malware?

A. Adding more features to the malware
B. Compressing or encrypting the executable to hide its code and evade detection
C. Zipping a file for email
D. Bundling malware with legitimate software

11 Which file format is the standard executable format for Windows, often analyzed during malware forensics?

A. PE (Portable Executable)
B. ELF
C. APK
D. Mach-O

12 When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?

A. JavaScript
B. Page margins
C. Image resolution
D. Text formatting

13 What is a common indicator of a malicious Microsoft Word document?

A. The presence of VBA Macros (Visual Basic for Applications)
B. The use of Arial font
C. The file size being under 1MB
D. The document having a .docx extension

14 Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?

A. Oledump.py
B. Metasploit
C. Burp Suite
D. Nmap

15 What is 'Dynamic Malware Analysis'?

A. Reading the source code
B. Scanning the file with an antivirus
C. Checking the file creation date
D. Running the malware in a controlled environment to observe its behavior

16 Which of the following is a risk associated with Dynamic Analysis?

A. It cannot identify network traffic
B. It requires access to the source code
C. It is only useful for text files
D. The malware might detect the virtual environment and stop running

17 What is the function of a 'snapshot' in a virtual machine during malware analysis?

A. To take a picture of the malware author
B. To print the code
C. To record the network traffic
D. To save the state of the VM so it can be reverted after infection

18 Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?

A. VLC
B. Process Monitor (ProcMon)
C. FileZilla
D. Putty

19 In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?

A. The browser is clearing cache
B. The malware is establishing persistence to run on startup
C. The system is updating
D. The screen resolution is changing

20 What is 'Process Injection'?

A. Monitoring a process for errors
B. Installing a new process via CD
C. Stopping a process efficiently
D. Code belonging to one process being written into the address space of another process

21 What is a 'Mutex' (Mutual Exclusion) object often used for by malware?

A. To ensure only one instance of the malware runs at a time
B. To connect to the internet
C. To delete system logs
D. To encrypt user files

22 Which network behavior is characteristic of C2 (Command and Control) communication?

A. Windows Update downloads
B. Local printing traffic
C. High bandwidth video streaming
D. Periodic 'beaconing' signals to an external server

23 What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?

A. To block all network traffic permanently
B. To increase internet speed
C. To hack into the malware author's computer
D. To simulate internet services (DNS, HTTP) so malware thinks it is online

24 What is a Fileless Malware attack?

A. Malware transmitted via paper
B. Malware that only targets empty files
C. Malware that deletes all files on a drive
D. Malware that exists primarily in memory without writing an executable file to the disk

25 Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?

A. LOLBins (Living off the Land Binaries)
B. Shareware
C. Bloatware
D. Firmware

26 Which of the following is a common entry point for fileless malware?

A. Exploit kits targeting browser vulnerabilities
B. A physical CD-ROM
C. Installing a fresh OS
D. Connecting a printer

27 What is the role of WMI (Windows Management Instrumentation) in fileless attacks?

A. It manages the mouse pointer
B. It can be used to execute scripts and maintain persistence without files
C. It acts as a firewall
D. It is used for graphics rendering

28 How does Domain Generation Algorithm (DGA) help malware?

A. It encrypts the hard drive
B. It generates random domain names to rendezvous with the C2 server, evading blacklists
C. It generates strong passwords for the user
D. It speeds up the infection process

29 Which tool is best suited for capturing and analyzing network packets during malware analysis?

A. Wireshark
B. Resource Hacker
C. Notepad++
D. RegEdit

30 What is 'import hashing' (Imphash)?

A. Hashing the user's password
B. Hashing the file name
C. Hashing the list of imported functions to identify related malware samples
D. Hashing the network traffic

31 What is a 'Trojan Horse'?

A. Self-replicating malware
B. Malware that locks the screen
C. Hardware used to steal data
D. Malware disguised as legitimate software to mislead users of its true intent

32 Which component of the PE header contains information about the compilation time of the malware?

A. Subsystem
B. Time Date Stamp
C. Pointer to Symbol Table
D. Machine Type

33 What does the term 'Obfuscation' mean in malware analysis?

A. Highlighting important code sections
B. Translating the code to English
C. Making the code difficult for humans and analysis tools to understand
D. Deleting the code

34 In the context of PDF analysis, what is a '/OpenAction'?

A. A font style
B. A permission setting
C. A command that specifies an action to perform immediately upon opening the document
D. A command to close the file

35 What is 'Sandboxing'?

A. Encrypting a hard drive
B. Cleaning the computer case
C. Playing a game
D. Automated dynamic analysis in a secure environment

36 Which of the following is a symptom of Ransomware?

A. The computer shuts down randomly
B. The web browser opens multiple tabs
C. Files are encrypted and a payment note is displayed
D. The mouse moves slowly

37 What is the primary difference between a Virus and a Worm?

A. Worms are only for Linux
B. Viruses encrypt files; Worms delete them
C. Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
D. Viruses are hardware-based

38 Why might an analyst check 'Imported Functions' (Imports) in the PE header?

A. To guess what the malware is capable of (e.g., networking, file manipulation)
B. To check the author's name
C. To see the file size
D. To see the icon

39 What does 'Shellcode' refer to in a malicious document?

A. The name of the file
B. The password protection
C. The visual layout of the document
D. Machine code payload used to exploit a vulnerability

40 Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?

A. TCPView
B. Calculator
C. Notepad
D. Paint

41 What is 'DLL Injection'?

A. Renaming a DLL file
B. Scanning DLLs for viruses
C. Removing a DLL file
D. Forcing a process to load a malicious Dynamic Link Library (DLL)

42 What is the 'AutoOpen' macro in Word?

A. A macro that prints the file
B. A macro that runs automatically when a document is opened
C. A macro that saves the file
D. A macro that changes the font

43 How can fileless malware persist using the Windows Registry?

A. By disabling the mouse
B. By changing the desktop background
C. By deleting the registry
D. By storing malicious scripts in registry keys and invoking them via PowerShell

44 Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?

A. ICMP
B. DNS (Domain Name System)
C. DHCP
D. ARP

45 What is the purpose of 'API Hooking' in malware?

A. To intercept function calls between the system and applications to modify or monitor behavior
B. To organize files
C. To fix bugs in Windows
D. To speed up the internet

46 Which section of a PE file typically contains the executable code?

A. .text
B. .reloc
C. .data
D. .rsrc

47 When analyzing a suspicious URL found in malware, what should an analyst do?

A. Email the URL to friends
B. Investigate it using reputation services or a safe sandbox environment
C. Ignore it
D. Open it in their personal browser immediately

48 What is the primary characteristic of a 'Rootkit'?

A. It displays ads
B. It spreads via USB
C. It encrypts files
D. It is designed to hide the existence of certain processes or programs from normal detection methods

49 What is 'Entropy' used for in static malware analysis?

A. To measure the network speed
B. To measure the file temperature
C. To measure the randomness of data, helping identify packed or encrypted code
D. To count the lines of code

50 Why is 'PowerShell' a frequent target for fileless malware?

A. It is a game engine
B. It has deep access to the Windows API and system management functions without needing new binaries
C. It is a web browser
D. It is not installed on most computers
Previous MCQ
Unit 5