WorksheetsCHFI Module 11 Malware Forensics
Total questions: 15
Worksheet time: 8mins
Malware testing should be done on what type of system?
investigators computer
standalone computer
any computer
internet capable computer
IDA Pro is a widely used program for malware disassembly
True
False
You can check the startup folders by using the run command shell:startup
True
False
To examine the start-up process, investigators can check the _______ _______ list for viewing services that start automatically when the system boots.
startup services
Windows services
system logs
Registry log
Components of malware are dependent upon ______________
The person receiving the malware attack
Both the sender and receiver of the malware attack
The person who authored the malware attack
The type of machine being used
The command netstat -an displays all active TCP connections as well as the TCP and UDP ports on which the computer is listening along with addresses and port numbers.
True
False
Process monitor is an important tool for Dynamic Malware Analysis
True
False
Dynamic Analysis is executing the malware and static is analyzing the code without executing it.
True
False
Disassembly of code is not part of Static Malware Analysis
True
False
In static analysis, you are analyzing code but not running it.
True
False
There are ___ types of malware forensics
4
2
3
6
Which configuration file is used in the Linux and UNIX based system to maintain logs of what happened in the system?
Send.conf
Wphost.db
Mail.conf
Syslog.conf
There are some common techniques used by the attackers to distribute malware across internet. One such technique is mimicking legitimate institutions in an attempt to steal login credentials is come under which category?
Social Engineered Clickjacking
Compromised Legitimate Websites
Spear Phishing Sites
Blackhat Search Engine Optimization (SEO)
In Port Monitoring the following command is used to look for connection established to unknown or suspicious IP addresses.
netstat -n
netstat-ns
netstat-na
netstat-sn
Identify the following common techniques used by the attackers to distribute the malware across the web.
‘Hosting embedded malware sites that spreads to unsuspecting visitors’ comes under which of the following technique.
social engineering
Compromised Legitimate Websites
malvertising
spear phishing sites
