Back to Subject

Unit 1: Introduction and Static Malware Analysis - Practice Quiz

INT251 — Malware Analysis And Cyber Defence 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is malware?

Introduction to malware Easy
A. A protocol used to encrypt web traffic
B. Hardware installed to improve network speed
C. Software used only to create documents
D. Software designed to cause harm or perform unauthorized actions

2 Which activity is commonly associated with malware?

Introduction to malware Easy
A. Updating authorized applications automatically
B. Organizing files alphabetically
C. Improving processor performance
D. Stealing sensitive information

3 Which type of malware can copy itself and spread across networks without attaching to another file?

Types of malware Easy
A. Rootkit
B. Adware
C. Worm
D. Trojan

4 Which type of malware disguises itself as legitimate software?

Types of malware Easy
A. Ransomware that encrypts files and demands payment through a digital currency
B. Trojan
C. Spyware
D. Worm

5 What is the main purpose of ransomware?

Types of malware Easy
A. To install approved security patches
B. To encrypt data and demand payment
C. To monitor network speed
D. To remove duplicate files

6 What is the main goal of malware analysis?

Malware analysis Easy
A. To increase the size of executable files
B. To understand malware behavior and capabilities
C. To improve the visual design of applications
D. To replace an operating system with a newer version

7 Which analysis method examines malware without executing it?

Types of malware analysis Easy
A. Static analysis
B. Behavioral analysis
C. Dynamic analysis
D. Network analysis performed while the sample communicates with external systems

8 Which analysis method observes malware while it is running in a controlled environment?

Types of malware analysis Easy
A. Header analysis
B. Dynamic analysis
C. Hash analysis
D. Static analysis

9 Why should an analyst inspect a file's contents instead of trusting only its extension?

Determining file type Easy
A. File extensions always contain malware
B. File contents cannot identify a format
C. File extensions can be changed or misleading
D. File extensions provide complete behavioral details about every executable

10 What are file signatures or magic bytes used for?

Determining file type Easy
A. Changing a file's access permissions
B. Recording every network connection made by a program
C. Identifying a file's actual format
D. Measuring a file's execution speed

11 Which value is commonly used as a digital fingerprint for a malware file?

Fingerprinting malware Easy
A. Screen resolution
B. File icon
C. Folder name
D. Hash value

12 Which hashing algorithm is commonly used to fingerprint files?

Fingerprinting malware Easy
A. HTTP
B. SHA-256
C. JPEG compression with maximum quality and embedded color profile information
D. ASCII

13 What is a benefit of scanning a suspicious file with multiple anti-virus engines?

Multiple anti-virus scanning Easy
A. It permanently removes every possible infection
B. It provides opinions from several detection engines
C. It guarantees that the file is completely harmless
D. It automatically reveals the malware's complete source code

14 If one anti-virus engine reports a file as malicious while many others do not, what should an analyst do?

Multiple anti-virus scanning Easy
A. Assume the file is certainly safe
B. Treat the result as a clue and investigate further
C. Delete all anti-virus software
D. Conclude that every other detection engine has failed because only one result is needed

15 What does the strings technique extract from a binary file?

Extracting strings Easy
A. Live network packets
B. Complete instructions translated into a high-level programming language
C. Encrypted disk sectors
D. Readable text sequences

16 Which item might be discovered by extracting strings from malware?

Extracting strings Easy
A. A physical description of the computer's internal wiring
B. A processor temperature
C. A monitor refresh rate
D. A domain name

17 Why do malware authors use packing or obfuscation?

Determining file obfuscation Easy
A. To document every function clearly for security analysts
B. To repair damaged hardware
C. To improve screen brightness
D. To hide code and make analysis harder

18 Which characteristic can suggest that an executable is packed or obfuscated?

Determining file obfuscation Easy
A. A standard desktop icon
B. A detailed digital manual explaining all of the program's features
C. A familiar file name
D. Very high entropy

19 What does PE stand for in the context of Windows executable files?

Inspecting PE header information Easy
A. Program Encryption
B. Process Evaluation
C. Portable Executable
D. Protected Encoding

20 How can hash values help when comparing two malware samples?

Comparing and classifying malware Easy
A. Matching hashes can indicate identical files
B. Different hashes always indicate the same file
C. Matching hashes prove different behavior
D. Different hashes reveal the exact programming language and author automatically

21 A program secretly modifies browser settings and sends browsing data to an external server without user consent. Which characteristic most directly makes the program malware?

Introduction to malware Medium
A. It was developed by an unknown vendor
B. It performs unauthorized and harmful actions
C. It does not include a graphical interface
D. It consumes more memory than expected

22 An employee opens a document that installs malicious code. The code then automatically spreads to other vulnerable computers without attaching itself to existing files. What type of malware is this?

Types of malware Medium
A. File-infecting virus
B. Network worm
C. Keylogger
D. Trojan horse

23 Malware encrypts a user's documents and displays a payment demand for the decryption key. Which classification best fits this behavior?

Types of malware Medium
A. Adware
B. Rootkit
C. Ransomware
D. Downloader

24 Before analyzing an unknown executable, an analyst creates a copy, records its hash, and changes the copy's permissions to read-only. What is the main purpose of these actions?

Malware analysis Medium
A. To prevent antivirus products from identifying the file
B. To preserve sample integrity and support verification
C. To remove malicious instructions from the executable
D. To make the sample compatible with every analysis tool

25 An analyst cannot execute a suspicious file because the laboratory lacks a compatible operating system. Which initial approach can still reveal imports, embedded strings, and section metadata?

Types of malware analysis Medium
A. Memory forensics
B. Network simulation
C. Static analysis
D. Dynamic analysis

26 A sample constructs its command-and-control address only after execution. Which analysis method is most likely to reveal the final address?

Types of malware analysis Medium
A. Monitoring runtime behavior
B. Computing a cryptographic hash
C. Checking the filename extension
D. Reviewing the PE timestamp

27 A file named invoice.pdf begins with the hexadecimal bytes 4D 5A. What is the most appropriate initial conclusion?

Determining file type Medium
A. The file is a text document containing a long embedded executable represented entirely as hexadecimal characters
B. The file is likely a Windows executable
C. The file is a valid PDF document
D. The file is an encrypted ZIP archive

28 A suspicious attachment has no filename extension. Which method provides the strongest initial evidence of its actual format?

Determining file type Medium
A. Reviewing the sender's displayed email address
B. Renaming it with the most common extension
C. Examining its magic bytes and internal structure
D. Checking the length of its original filename

29 Two investigators need to verify that they received byte-for-byte identical malware samples. Which value should they compare?

Fingerprinting malware Medium
A. The SHA-256 hash
B. The PE section count
C. The executable filename
D. The file creation time

30 An attacker changes one unused byte in a malware sample. What is the expected effect on its SHA-256 fingerprint?

Fingerprinting malware Medium
A. Only one hash character should change
B. The hash should become one byte longer
C. The hash should remain unchanged
D. The hash should change substantially

31 A multi-engine scanning service reports that 2 of 60 engines detect a new sample, while the other engines report no detection. What is the best interpretation?

Multiple anti-virus scanning Medium
A. The two detections prove that the sample belongs to the malware family named by whichever engine supplied the most detailed detection label
B. The result requires further investigation
C. The sample is certainly benign
D. The sample is certainly malicious

32 Different antivirus engines assign unrelated family names to the same suspicious file. Why can this occur?

Multiple anti-virus scanning Medium
A. Vendors use different naming schemes and signatures
B. Every engine receives a different version of the file
C. Family names are derived only from file size
D. The operating system randomly changes detection labels

33 An ASCII strings scan finds little useful information, but a hex viewer shows readable letters separated by null bytes. What should the analyst try next?

Extracting strings Medium
A. Extract UTF-16 little-endian strings
B. Recalculate the file's MD5 hash
C. Rename the file as a text document
D. Remove every null byte from the sample and execute the modified binary to expose its original behavior

34 A static strings report contains CreateProcessW, Software\\Microsoft\\Windows\\CurrentVersion\\Run, and a domain name. What is the most defensible conclusion?

Extracting strings Medium
A. The file is a driver because it references the Windows registry
B. The file certainly performs all three actions whenever it executes
C. The file is harmless because the strings are readable
D. The file may launch processes, establish persistence, and contact a host

35 A PE file has very few readable strings, an unusually small import table, and one section with entropy close to 8 bits per byte. What is the most likely explanation?

Determining file obfuscation Medium
A. The file contains only source code
B. The file is digitally signed
C. The file is packed or encrypted
D. The file was compiled without optimization

36 Two sections have entropy values of approximately 3.1 and 7.9 bits per byte. Which section deserves closer inspection for possible packing?

Determining file obfuscation Medium
A. The section with entropy 3.1
B. Both sections are equally likely
C. The section with entropy 7.9
D. Neither section, because entropy can identify packing only after the executable has been allowed to communicate with the internet

37 A PE entry point falls inside a section named .data that is both writable and executable. Why is this noteworthy?

Inspecting PE header information Medium
A. It proves the executable is a system driver
B. It may indicate packing or injected code
C. It guarantees the file was compiled by Microsoft
D. It means the section contains only configuration data

38 A suspicious PE imports VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Which behavior do these imports collectively suggest?

Inspecting PE header information Medium
A. Process injection
B. Password hashing
C. Screen capture
D. Document printing

39 Two samples have different SHA-256 hashes but highly similar function structures, imports, and control-flow patterns. What is the most reasonable assessment?

Comparing and classifying malware Medium
A. They cannot belong to the same family
B. They must be byte-for-byte identical
C. They may be variants of the same family
D. They must target different operating systems

40 An analyst wants to group malware variants despite minor recompilation changes that produce different cryptographic hashes. Which technique is most suitable?

Comparing and classifying malware Medium
A. Selecting the antivirus family name that appears first alphabetically and assigning it to every sample in the collection
B. Checking only file timestamps
C. Comparing only filenames
D. Using fuzzy hashing

41 A digitally signed enterprise updater silently installs a cryptominer, disables competing miners, and sends proceeds to an unauthorized wallet. Which conclusion is most defensible?

Introduction to malware Hard
A. It is a vulnerability exploit because it modifies another program's configuration.
B. It is benign because cryptomining is a legitimate computational activity.
C. It is potentially unwanted software because signed executables cannot be classified as malware.
D. It is malware because its unauthorized behavior and intent outweigh its valid signature.

42 A small executable contains an encrypted second executable in its resources. When run, it writes that embedded executable to disk and launches it, but never contacts a network. What is the most precise classification of the first executable?

Types of malware Hard
A. Loader, because it propagates the payload between network hosts.
B. Worm, because it executes another program without user approval.
C. Dropper, because it extracts and installs an embedded payload.
D. Downloader, because it obtains and executes a secondary payload.

43 Static inspection reveals WinINet imports, a string resembling a registry Run key, and a high-entropy resource. Before executing the sample, which report statement is analytically sound?

Malware analysis Hard
A. The sample is benign unless its imported functions are observed during execution.
B. The artifacts suggest persistence and networking capabilities but do not prove execution.
C. The sample certainly establishes persistence and exfiltrates data through HTTP.
D. The high-entropy resource proves that the sample contains ransomware encryption keys.

44 A sample decrypts its configuration only when a domain-join check succeeds and otherwise exits. Which analysis strategy is most effective for recovering the configuration while preserving contextual understanding?

Types of malware analysis Hard
A. Use only antivirus labels and select the configuration associated with the majority family name.
B. Use unrestricted execution on a production domain so every environmental condition is genuine.
C. Use only static disassembly and treat the encrypted bytes as the final configuration.
D. Use hybrid analysis to locate the check, force the branch, and dump decrypted memory.

45 A file named invoice.jpg begins with MZ. Its DOS header field e_lfanew points to a valid PE\0\0 signature, coherent COFF fields, and consistent section boundaries. What is the best file-type determination?

Determining file type Hard
A. It is a DOS-only executable because the first two bytes are the complete format signature.
B. It is a Windows PE executable disguised with a misleading image extension.
C. It is a JPEG because the filename extension takes precedence over internal metadata.
D. It is a PE-JPEG polyglot because every extension mismatch establishes two valid formats.

46 An analyst must identify exact duplicates while also discovering variants produced by small byte-level modifications. Which fingerprinting strategy best satisfies both goals?

Fingerprinting malware Hard
A. Use only TLSH because similarity hashes provide collision-resistant exact identification.
B. Use only MD5 because every small modification produces a proportionally small hash change.
C. Use SHA-256 for identity and a similarity hash such as TLSH for relatedness.
D. Use the PE timestamp for identity and the filename for variant-family matching.

47 On a multi-engine service, 12 engines report Trojan.Generic, 3 report ransomware families, and 55 report no detection. Which interpretation is most defensible?

Multiple anti-virus scanning Hard
A. The sample is benign because a majority of engines produced no detection.
B. The sample belongs to a new family whose canonical name must be Trojan.Generic.
C. The sample is confirmed ransomware because at least one engine used that category.
D. The sample is suspicious, but the conflicting labels do not establish a family or capability.

48 A hexadecimal view contains the sequence 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00 6C 00 6C 00, but a default ASCII strings tool does not report it. What should the analyst do?

Extracting strings Hard
A. Disassemble the sequence because it is an x86 instruction stream.
B. Extract UTF-16LE strings because null bytes separate the encoded characters.
C. Extract UTF-8 strings because every character is represented by two bytes.
D. Decode the sequence as Base64 because the zeros indicate padding bytes.

49 A PE has very few imports, an entry point inside a writable section with entropy near 7.9 bits per byte, and several large sections with nonstandard names. Which conclusion is best?

Determining file obfuscation Hard
A. The evidence proves polymorphism because writable sections are generated for every infection.
B. The file is certainly encrypted and cannot execute under the Windows loader.
C. The file is certainly compressed because entropy uniquely distinguishes compression from encryption.
D. The evidence strongly suggests packing, so unpacking should be prioritized before deeper analysis.

50 A PE entry-point RVA is 0x2340. The containing section has VirtualAddress = 0x2000 and PointerToRawData = 0x600. Assuming the RVA is backed by raw section data, what is the entry point's file offset?

Inspecting PE header information Hard
A. 0x740
B. 0x940
C. 0x2940
D. 0x1D40

51 Two samples have the same import hash but different code-section hashes, control-flow structures, and network protocols. What is the safest classification decision?

Comparing and classifying malware Hard
A. Treat the import match as weak evidence and compare additional structural and behavioral features.
B. Assign them to different families because related samples cannot have different code hashes.
C. Assign them to the same family because an import hash is a unique code fingerprint.
D. Treat both samples as benign because family classifiers require identical cryptographic hashes.

52 A sample has a PE compilation timestamp in 2035, but it was obtained in 2025 and has a trusted timestamped signature from 2024. What is the strongest inference?

Inspecting PE header information Hard
A. The trusted signature is automatically invalid because it predates the PE header timestamp.
B. The sample originated in 2035 and was transported backward through a virtual machine snapshot.
C. The operating system will refuse to load the executable until the compilation year is reached.
D. The PE compilation timestamp is unreliable or manipulated and should be cross-checked with other evidence.

53 A custom PE parser cannot locate the Authenticode certificate because it translates the Security Directory's VirtualAddress field as an RVA. What is the parser's error?

Inspecting PE header information Hard
A. The Security Directory field is relative to the executable entry point.
B. The Security Directory field is an ordinal in the import address table.
C. The Security Directory field is a file offset rather than an image RVA.
D. The Security Directory field is a virtual address assigned after relocation.

54 Disassembly beginning at AddressOfEntryPoint appears benign, yet the PE contains a valid TLS directory with callback addresses. Why must those callbacks be inspected?

Inspecting PE header information Hard
A. TLS callbacks replace section permissions after the process has permanently terminated.
B. TLS callbacks are invoked exclusively when a network TLS connection is established.
C. TLS callbacks contain only compiler metadata and cannot execute application instructions.
D. TLS callbacks can execute before the nominal entry point and hide initialization behavior.

55 A section has VirtualSize = 0x5000 and SizeOfRawData = 0x400. The entry point lies in the portion beyond the raw bytes. Which interpretation is most accurate?

Inspecting PE header information Hard
A. The section is necessarily corrupt because virtual size must equal raw size exactly.
B. The loader maps the final 0x4C00 bytes directly from the PE certificate table.
C. The entry point is read from disk at an offset equal to the section's virtual address.
D. The loader zero-initializes the unbacked region, which may later receive generated or unpacked code.

56 Two PE files have identical headers and section hashes but different whole-file SHA-256 values. One file contains 8 KB of data after the final mapped section. What is the best next step?

Comparing and classifying malware Hard
A. Classify the files as identical because unmapped bytes can never affect malware behavior.
B. Classify the files as unrelated because any SHA-256 difference proves distinct program logic.
C. Inspect the overlay for configuration or payload data before deciding their relationship.
D. Delete the overlay because the Windows loader always executes it before the entry point.

57 A newly collected, high-entropy executable receives zero detections across many antivirus engines. Which conclusion is appropriate?

Multiple anti-virus scanning Hard
A. The file remains unresolved because new, private, or obfuscated malware may evade signatures.
B. The file is corrupted because valid executables must trigger at least one heuristic engine.
C. The file is benign because independent engines collectively provide a formal safety proof.
D. The file is ransomware because high entropy always represents encrypted victim documents.

58 An adversary appends a random overlay to each copy of a PE without changing its import table. Which fingerprint is most likely to remain identical across those copies?

Fingerprinting malware Hard
A. The whole-file SHA-256 value
B. The whole-file MD5 value
C. The import hash value
D. The file-size value

59 A sample imports only LoadLibraryA and GetProcAddress, contains many 32-bit constants, and resolves functions by comparing computed values rather than plaintext names. Which technique is most likely present?

Determining file obfuscation Hard
A. Control-flow flattening used to reorder PE section-table entries
B. Digital signing used to encrypt the executable's import directory
C. API hashing used to conceal dynamically resolved function names
D. String interning used to expose all API names in a shared table

60 Several samples share one mutex string and a common packer, but their unpacked code, command protocols, configurations, and persistence mechanisms differ substantially. What is the most defensible family assessment?

Comparing and classifying malware Hard
A. They are probably distinct because the shared artifacts may come from reused tooling or templates.
B. They belong to one family because a shared mutex is sufficient for definitive attribution.
C. They are identical variants because a common packer guarantees a common source-code base.
D. They cannot be compared because unpacked code is less reliable than visible packed bytes.
Next MCQ
Unit 2