Unit 5: Obfuscation and Malware Forensics - Practice Quiz

1 Which encoding scheme commonly represents binary data using letters, digits, and symbols such as + and /?

2 What is a key difference between encoding and encryption?

3 Why might malware encrypt its configuration data?

4 What is custom encoding in malware?

5 What is the main goal of malware unpacking?

6 When is packed malware often unpacked automatically?

7 What should an analyst normally do after obtaining a memory image?

8 What does memory acquisition collect from a running computer?

9 Why should RAM usually be acquired before shutting down a suspected system?

10 What is Volatility primarily used for?

11 What does enumerating processes reveal?

12 Which process detail is commonly useful when identifying suspicious activity?

13 What can a process handle reference in Windows?

14 Why would an analyst dump a suspicious executable from memory?

15 What can a list of network connections reveal during malware analysis?

16 What does a listening socket indicate?

17 Why do analysts inspect the Windows Registry during malware forensics?

18 Why might a malicious program install itself as a Windows service?

19 What can extracted command history show an investigator?

20 What does listing DLLs for a process help identify?

21 A malware sample stores the string powershell.exe as cG93ZXJzaGVsbC5leGU=. Which decoding operation should an analyst try first?

22 An analyst discovers the bytes 68 74 74 70 3A 2F 2F in a malware configuration. What does interpreting them as ASCII reveal?

23 A malware executable contains a high-entropy data section that becomes readable configuration data after the sample starts. What is the most effective next action?

24 Several encrypted configuration blocks use the same stream-cipher key and nonce. Two ciphertexts are and . What does produce?

25 A custom decoder processes each byte using . The encoded byte is 0x44. What is the decoded byte?

26 A suspected custom encoding repeatedly applies XOR with a four-byte key. Which observation would most strongly support this hypothesis?

27 During dynamic unpacking, execution leaves a small unpacking stub and enters a newly written memory region containing valid PE-like code. What should the analyst do next?

28 Which API sequence most strongly suggests that one process is unpacking or injecting code into another process?

29 After receiving a memory image, which workflow best preserves forensic reliability before detailed analysis?

30 A responder must acquire RAM from a running compromised server. Which approach is most appropriate?

31 Why should a responder document the acquisition tool, command, time, and output hash when collecting memory?

32 A Volatility plugin produces invalid addresses and implausible process results. What should the analyst verify first?

33 A process appears in a Volatility psscan result but not in pslist. Which interpretation is most appropriate?

34 The process tree shows winword.exe spawning powershell.exe, which then launches rundll32.exe. Why is this chain suspicious?

35 A suspicious process has an open handle to \Device\PhysicalMemory and several handles to security-related processes. What does this most directly justify?

36 An analyst finds a suspicious process whose executable no longer exists on disk. What is the best memory-forensics action?

37 Volatility reports an established TCP connection from PID 2480 to an unfamiliar external address on port 443. What is the most useful next correlation?

38 A memory-resident registry value under Software\Microsoft\Windows\CurrentVersion\Run launches an executable from a user's temporary directory. What behavior does this most likely indicate?

39 A service discovered in memory has an automatic start type, a random-looking name, and an executable path inside C:\Users\Public. What is the best assessment?

40 Recovered console history contains whoami, net user, and ipconfig /all, followed by a download command. What does this sequence most likely represent?

41 A memory buffer begins with TVqQAAMAAAAEAAAA, while the corresponding file is absent from disk. Which action most directly tests whether this is a simply encoded Windows executable?

42 An analyst finds a Base64-looking PowerShell argument whose length is valid, but ordinary Base64 decoding produces alternating printable characters and null bytes. What is the most likely explanation?

43 Two encrypted configuration blobs from separate infections have identical 16-byte prefixes but different later blocks. Both plaintexts are believed to begin with the same JSON header. Which implementation flaw is most strongly indicated?

44 A malware sample decrypts strings by XORing ciphertext with the output of a deterministic pseudorandom generator seeded from a constant. Why can this behave like a reusable stream cipher weakness?

45 A decoder transforms each byte using , where is the zero-based position. Which operation correctly reconstructs plaintext byte ?

46 A suspected custom decoder reads one input byte, emits two output nibbles through a lookup table, and rejects symbols outside a 16-character alphabet. Which artifact is most useful for reconstructing the encoding without executing the malware?

47 During dynamic unpacking, execution leaves a small loader stub and reaches a newly writable-then-executable region containing coherent PE code. What is the best point to dump the process image?

48 A dumped unpacked PE contains valid code and sections but fails because its imports point into addresses resolved in the original process. What post-processing is primarily required?

49 A responder has one RAM image and suspects process injection. Which workflow best preserves evidentiary integrity while minimizing premature conclusions?

50 A Windows host uses full-disk encryption, and malware is believed to keep its configuration only in memory. Why should live RAM acquisition generally precede shutdown?

51 An acquisition tool can write a RAM image either to the suspect system disk or to a prepared external device. Assuming both methods work, which choice usually has the lower evidence impact?

52 A Volatility 3 analysis fails because an exact Windows symbol table is unavailable locally. Which statement best describes the appropriate next step?

53 On a Windows image, a process appears in a pool scan but not in the active process list. Which conclusion is most defensible without additional evidence?

54 A process has parent PID 900, but PID 900 was created ten minutes after the child. Which interpretation should an analyst prioritize?

55 A suspicious process has a handle to \Device\PhysicalMemory with powerful access rights. Why is this more significant than merely finding the object name as a string?

56 A memory-dumped DLL has correct executable code but differs substantially from the on-disk file. Which factor most complicates direct hash comparison?

57 A pool scan finds a TCP endpoint owned by a process that has already exited, but the endpoint is absent from the active connection listing. What is the strongest interpretation?

58 A memory-resident registry hive shows a malicious Run-key value that is absent from the corresponding hive file collected after shutdown. Which explanation best fits both observations?

59 A service registry entry names svchost.exe, but memory analysis shows its service DLL loaded from a user-writable directory. Which artifact most directly identifies the payload configured for that shared-host service?

60 Memory analysis recovers a console command from a history buffer, but no matching process is currently active. What is the most accurate evidentiary interpretation?