NEW
Font size
WorksheetsMalware and Computer Science Worksheet
Total questions: 44
Worksheet time: 22mins
Which one of the following is the use of function in python?
Functions don’t provide better modularity for your application
You can’t also create your own functions
Functions are reusable pieces of programs
All of the mentioned
Which technique makes an executable large?
Static linking
Runtime linking
Dynamic linking
Packing
Which of the following statements about PEiD is true?
It can only identify packers used in Windows executables
It is a standalone antivirus software
It requires an internet connection to function
It can identify both packers and compilers used in executable files
Which new development in malware caused sandbox technology to automate and introduce intelligence learning?
AI-driven attacks
Trojan horse
Ransomware
Polymorphic viruses
What is a common method used in dynamic analysis of malware?
Disassembling the malware code
Running the malware in a controlled environment
Identifying the malware’s author
Searching for similar malware online
Which feature characterizes third-generation sandbox technology?
Automation and artificial intelligence
Streamlines manual testing
Faster network speeds
Scanning of encrypted data streams
What is a packer in the context of malware?
A device used to physically secure a computer
A tool used to expand malware files
A technique used to hide malware from detection
A type of malware designed to infiltrate networks
How does ransomware utilizing cryptoviral extortion ensure that victims must pay the ransom?
It steals passwords and banking information
It encrypts the victim’s files, making them inaccessible without a decryption key
It continuously downloads additional malware onto the system
It remotely controls all applications on the infected machine
Which of the following is NOT a common goal of malware analysis?
Identifying the source of malware
Developing antivirus software
Understanding malware behavior
Creating new types of malware
Which of these contains the EIP?
CPU
RAM
Control unit
Registers
ALU
What does OllyDbg’s “Memory Map” feature allow analysts to do during malware analysis?
Analyze network traffic
View a map of memory allocations and sections
Monitor system performance
Decrypt encrypted malware payloads
Which debugger is commonly used for analyzing Windows-based malware?
GDB
OllyDbg
LLDB
WinDbg
How does a rootkit differ from other types of malware?
Rootkits are only effective on Windows operating systems
Rootkits modify system files to grant unauthorized access, while other malware focuses on data theft or disruption
Rootkits spread through email attachments
Rootkits require physical access
What type of information can be extracted from the Windows registry using RegRipper?
Only user passwords
Only file system information
System configurations, user activities, and installed software details
Only network configurations
Which of the following best describes how a worm spreads in a network?
Requires user interaction
Attaches to executable files
Autonomously scans for vulnerable systems and replicates itself
Encrypts data and demands ransom
Which of the following is the use of id() function in Python?
Every object in Python doesn’t have a unique id
In Python the id function returns the identity of the object
None of the mentioned
All of the mentioned
The register that indicates whether the last operation resulted in zero is:
EAX, EBX, ECX, or EDX
EAX, EBX, ECX, or EDX
EFLAGS
EIP
What is one of the most common formats used for storing memory dumps in memory forensics?
TXT
DOCX
RAW (Binary)
JPG
What is the primary goal of memory forensics?
Recovering deleted files from storage
Analyzing network traffic
Extracting information from volatile memory of a system
Decrypting encrypted files on disk
Which phase of the dual-phased analysis process involves observing the actions of malware in a controlled environment?
Code analysis
Behavioral analysis
Execution analysis
Network analysis
What type of language is bash shell script?
Low-level languages
Lowest languages
Machine code
Interpreted languages
Hardware
What ethical considerations should malware analysts keep in mind during their work?
Ensuring complete anonymity when analyzing malware
Respecting privacy and legal boundaries when handling samples
Sharing malware samples freely with other analysts
Using malware for personal gain or hacking activities
Which of the following is a best practice when handling malware samples?
Ensuring complete anonymity when analyzing malware
Respecting privacy and legal boundaries when handling samples
Sharing malware samples freely with other analysts
Using malware for personal gain or hacking activities
Which instruction is repeated many times in buffer overflow attacks?
A. mov
B. sub
C. nop
D. push
E. pop
What is a hardware keylogger?
A keylogger that captures screenshots
A keylogger that records keystrokes through physical devices
A keylogger that sends data to a remote server
A keylogger that disguises itself as legitimate software
Code snippet question Int b = 1; main(){int x = 2; printf("%d %d", x, b);} Which location is likely one for x?
.rdata: 00416111
[ebp+var_8]
eax
eip
What type of data does Process Monitor display in real-time?
CPU temperature
Network bandwidth usage
Registry and file system activity
Installed software list
In the Windows operating system, which item opens with higher privileges than administrator?
DLL
Process
Mutex
Services
Component Object Model (COM)
Which register is used to hold values such as subtotals during calculations?
A. EAX, EBX, ECX, or EDX
B. EBP or ESP
C. EFLAGS
D. EIP
What type of information can be extracted from the Windows registry using RegRipper?
Only user passwords
Only file system information
System configurations, user activities, and installed software details
Only network configurations
What is the primary function of a rootkit in a compromised system?
To create a backdoor for future access
To infect other computers via network propagation
To hide the presence of other malicious software
To extract sensitive financial information
Which network type is the most hazardous?
Host-only
NAT
Bridged
Airgap
What is the main disadvantage of using physical systems in a malware analysis lab?
Lack of system state-restoring options
High costs and space requirements
Inability to perform code analysis
Difficulty in monitoring behavioral changes
What differentiates a worm from a virus?
Worms require user interaction to spread, while viruses can spread autonomously.
Viruses infect files, while worms can spread independently through networks.
Worms primarily target system files, viruses target user data.
Viruses only spread through email, worms spread through multiple vectors.
What is the primary purpose of using a sandbox in malware analysis?
To permanently remove malware
To execute malware in a controlled environment and monitor behavior
Detect malware signatures without execution
Encrypt malware samples for storage
What is a common use of LordPE in malware analysis?
Decrypt malware payloads
Generate antivirus signatures
Analyze & modify import table of malware executables
Monitor system logs
Output of Python expression: round(4.576)
4
4.6
5
4.5
What is the primary purpose of using PEiD in malware analysis?
Analyzing network traffic
Identifying packers & compilers used in executables
Decrypting encrypted files
Debugging malware code
Role of a debugger in malware analysis?
To statically analyze malware behavior
Slow down execution & observe code in real-time
Extract all functions in executable
Capture network traffic
Which file format does Regshot use to save registry snapshots?
.txt
.exe
.reg
.dll
What is static analysis in malware analysis?
Running the malware in a controlled environment
Analyzing the behavior of malware as it executes
Examining the code and structure of malware without executing it
Monitoring network traffic for signs of malware activity
What is the primary purpose of using a debugger in malware analysis?
To execute malware on a system
To monitor network traffic
To trace and analyze malware behavior
To encrypt sensitive data
Which tool is commonly used for memory forensics?
Wireshark
Volatility
Snort
IDA Pro
In malware analysis, what is the purpose of using the Python library pefile?
For analyzing packet captures
For parsing and analyzing PE (Portable Executable) files
For generating shellcode
For obfuscating Python code
