CHFI Module 11 Malware Forensics

Malware testing should be done on what type of system?

• investigators computer

• standalone computer

• any computer

• internet capable computer

IDA Pro is a widely used program for malware disassembly

• True

• False

You can check the startup folders by using the run command shell:startup

• True

• False

To examine the start-up process, investigators can check the _______ _______ list for viewing services that start automatically when the system boots.

• startup services

• Windows services

• system logs

• Registry log

Components of malware are dependent upon ______________

• The person receiving the malware attack

• Both the sender and receiver of the malware attack

• The person who authored the malware attack

• The type of machine being used

The command netstat -an displays all active TCP connections as well as the TCP and UDP ports on which the computer is listening along with addresses and port numbers.

• True

• False

Process monitor is an important tool for Dynamic Malware Analysis

• True

• False

Dynamic Analysis is executing the malware and static is analyzing the code without executing it.

• True

• False

Disassembly of code is not part of Static Malware Analysis

• True

• False

In static analysis, you are analyzing code but not running it.

• True

• False