112-57 Practice Questions

The scenario describes the process of reverse engineering a malware file by analyzing its assembly code. OllyDbg is a 32-bit assembler-level analyzing debugger for Microsoft Windows. Its primary function is to analyze binary code (executables) when the source code is unavailable. It allows a forensic expert like Cheryl to load the malware, step through its assembly instructions, view memory and registers, and set breakpoints. This process is fundamental to understanding the malware's functionality, purpose, and behavior, which directly matches the actions described in the question.

A. Virtual Box: This is a hypervisor used to create isolated virtual environments (sandboxes) for safely running and observing malware, not for directly analyzing its assembly code.

B. QualNet: This is a network simulation and modeling software used to analyze network performance and behavior. It is not used for malware reverse engineering.

D. VMware vSphere: This is an enterprise-class server virtualization platform. Like VirtualBox, it provides an environment but is not a tool for debugging or analyzing assembly code.

1. EC-Council Certified Threat Intelligence Analyst (C|TIA) v1.0 Courseware, Module 06: Malware Analysis, Section: "Tools for Malware Analysis," Sub-section: "Debuggers." This section explicitly lists OllyDbg as a primary tool for debugging and analyzing executable files at the assembly level.

2. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. (This book is a standard textbook in numerous university cybersecurity curricula). Chapter 5, "Debugging," extensively covers the use of OllyDbg for dynamic analysis of malware by stepping through assembly code.

3. Rensselaer Polytechnic Institute (RPI) Courseware, CSCI-4974/6974: Malware Analysis, Lecture 7: "Dynamic Analysis: Debugging." The lecture notes and associated labs detail the use of debuggers like OllyDbg to inspect and understand a program's execution flow at the assembly level.

Spimming is a specific type of spam attack that leverages Instant Messaging (IM) platforms. The term is a portmanteau of "spam" and "IM." Attackers use this method to send unsolicited messages in bulk to IM users. These messages often contain malicious links designed to spread malware, direct users to phishing websites, or advertise fraudulent services. The core characteristic of spimming is the use of instant messaging as the delivery vector for spam, which directly matches the scenario described in the question.

A. Whaling: This attack is a form of spear phishing that specifically targets high-profile individuals, such as senior executives (CEOs, CFOs), not defined by the use of IM.

B. Pharming: This is a technical attack that redirects users to a fraudulent website by compromising DNS servers or modifying a local host file, not by sending messages.

D. Spear phishing: This refers to a highly targeted phishing attack aimed at a specific individual or organization. While it could use IM, its defining feature is targeting, not the medium itself.

1. National Institute of Standards and Technology (NIST) - Computer Security Resource Center (CSRC) Glossary.

Spim: "Unsolicited commercial bulk messages sent over instant messaging (IM) systems." (This is the root term for Spimming).

Whaling: "A type of phishing that targets high-profile employees..."

Pharming: "A phishing technique that seeks to redirect a user’s web traffic to a fraudulent website..."

Spear Phishing: "A targeted phishing attack that is tailored to a specific person or organization."

Source: NIST CSRC Glossary, entries for "Spim," "Whaling," "Pharming," and "Spear Phishing." Retrieved from https://csrc.nist.gov/glossary

2. Academic Publication defining Spim/Spimming.

O. A. Mohammed, J. H. Abass, and A. J. Abboud, "A survey on phishing and its countermeasures," in 2017 Annual Conference on New Trends in Information & Communications Technology Applications (NTICT), 2017, pp. 22-27.

Reference: Section II, Part C, "Types of Phishing," defines Spim as "unsolicited instant messages." This paper categorizes it as a distinct type of phishing attack based on the delivery vector.

DOI: https://doi.org/10.1109/NTICT.2017.7976111

3. University Courseware Context.

Carnegie Mellon University, Software Engineering Institute (SEI). While not a direct course, the SEI's publications and glossaries are foundational to many academic curricula.

Reference: The CERT Guide to Coordinated Vulnerability Disclosure, Glossary, defines related terms like phishing in a manner consistent with NIST, reinforcing the standardized definitions used in academia and government. For example, phishing is defined as "A technique for attempting to acquire sensitive data... by masquerading as a trustworthy entity in an electronic communication." Spimming is a specialized form of this.

Source: The CERT Division, Software Engineering Institute, Carnegie Mellon University. (e.g., "Common Sense Guide to Mitigating Insider Threats, 6th Edition," provides context on social engineering vectors).

In event correlation (as applied in SOC/SIEM-driven investigations), the workflow typically starts by

reducing complexity and normalizing what “one incident” looks like before attempting conclusions

about causality. Event aggregation (2) is performed early to combine multiple low-level, related

events (for example repeated authentication failures, repeated firewall denies, or multiple IDS hits

for the same signature) into higher-level “grouped” records. This prevents analysts from treating

every raw log line as a separate incident and makes correlation computationally and operationally

feasible.

Next, event masking (1) suppresses events that are already known to be irrelevant or repetitive in a

way that does not add investigative value (for example, routine scheduled scans, approved admin

tools, or duplicate alerts already represented in the aggregated set). After masking, event filtering (4)

further removes remaining noise using rules, thresholds, whitelists, time windows, or relevance

criteria (scope, asset criticality, and known-benign sources), leaving a cleaner dataset that represents

probable security-relevant activity.

Only after the dataset is consolidated and noise-reduced does root cause analysis (3) become

reliable, because RCA depends on a clear chain of correlated events to identify the initiating action

and propagation path. Hence the correct sequence is 2 → 1 → 4 → 3 (Option B).

The scenario describes a victim being redirected from a legitimate banking URL to a fraudulent

website without intending to visit it, after malware is installed on the system. This behavior is

characteristic of pharming, an attack in which an adversary causes redirection to a malicious

destination even when the user types the correct address or clicks a legitimate bookmark. In digital

forensics

, pharming is commonly achieved by manipulating name resolution or routing

mechanisms, such as altering the local hosts file, changing DNS server settings, poisoning DNS

responses, modifying browser proxy settings, or installing malware that intercepts and rewrites web

requests. The key forensic indicator is that the victim’s request for the real domain is transparently

diverted to attacker-controlled infrastructure, where credentials are harvested through a convincing

spoofed login page.

The other options do not match the redirection-and-fake-site mechanism. Tailgating is physical

access abuse (following someone into a secure area). Dumpster diving involves retrieving sensitive

information from discarded materials. Shoulder surfing is observing credentials by watching the

victim type. Because the essential action here is malicious redirection to a fake site to steal

credentials, the correct answer is Pharming (A).

Monitoring host integrity is a fundamental technique in dynamic malware analysis. It involves establishing a known-good baseline of a system by taking a snapshot of its state, including the file system, registry, running processes, and network connections. The suspected malware is then executed within this controlled environment. Afterward, a second snapshot is taken. By comparing the "before" and "after" snapshots, an analyst can precisely identify the changes and modifications made by the malware, revealing its behavior and impact on the host system.

A. Online malware scanning: This technique involves uploading a suspicious file to a web service (e.g., VirusTotal) for analysis by multiple antivirus engines, not creating a local system baseline.

C. String search: This is a static analysis technique used to find embedded, human-readable text like IP addresses or commands within the malware's code without executing it.

D. File fingerprinting: This process generates a unique hash value (e.g., MD5, SHA-256) for a file to identify it, but it does not involve taking a snapshot of the entire system state.

1. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

Chapter 1, Section: "Dynamic Analysis," pp. 12-13: The text explicitly describes dynamic analysis as involving the execution of malware and observing its behavior. It highlights the importance of using tools that monitor system changes, which is achieved by comparing the system state before and after execution. This process is the core of host integrity monitoring.

2. Zeltser, L. (2010). Automated Dynamic Malware Analysis. SANS Institute InfoSec Reading Room.

Section: "How Automated Dynamic Malware Analysis Tools Work," p. 3: "The tool takes a snapshot of the system’s state before running the specimen. After the program terminates... the tool takes another snapshot. The tool then compares the 'before' and 'after' snapshots to identify changes that the specimen made to the file system and the registry." This directly describes the process of monitoring host integrity via baselining.

3. NIST Special Publication 800-83 Rev. 1. (2013). Guide to Malware Incident Prevention and Handling for Desktops and Laptops. National Institute of Standards and Technology.

Section 3.3.2, "Analyzing Malware in a Lab," p. 23: This section discusses the use of sandboxes for malware analysis, which often "revert to a clean baseline state after each use." This principle of using a baseline state is central to the technique of monitoring host integrity to detect malware-induced changes.

The provided regular expression, /((%3C)|)/i, is specifically constructed to detect the fundamental structure of an HTML tag. It identifies a string that begins with either a literal less-than sign () or its encoded form (%3E). Since Cross-Site Scripting (XSS) attacks commonly involve injecting malicious code encapsulated within HTML tags (e.g., <script>, , ), this regex signature is a primary method for identifying such attempts. The /i flag makes the pattern case-insensitive, broadening its detection capability.

B. CSS attack: This regex does not target the specific syntax of CSS-based attacks, such as expression() or @import, which follow different patterns.

C. Simple XSS attack: This term is too vague and not a standard classification. The regex targets a specific vector (HTML tags), making option A more precise.

D. In-line comment XSS attack: The regex is not designed to match the distinct structure of an HTML comment, which is .

1. OWASP Foundation. "XSS Filter Evasion Cheat Sheet." OWASP. Accessed May 23, 2024. The document extensively discusses methods to bypass filters that look for HTML tag characters like , confirming that detecting these characters is a fundamental, signature-based approach to preventing HTML tag-based XSS.

2. Vogt, P., Nentwich, F., Jovanovic, N., Kirda, E., Kruegel, C., & Vigna, G. (2007). "Cross-site scripting prevention with dynamic data tainting and static analysis." In Proceedings of the 14th Annual Network and Distributed System Security Symposium (NDSS'07). This paper discusses XSS prevention techniques, where the foundational detection method often involves identifying and sanitizing HTML metacharacters like , which the provided regex targets (Section 2.1, Background on XSS).

3. Johns, M. (2006). "An Introduction to Cross-Site Scripting (XSS)." SANS Institute InfoSec Reading Room. This SANS whitepaper explains that a common defense is to filter user input for HTML tags, which involves looking for the characters, the exact pattern matched by the given regex (Page 6, "Filtering User Input").

The Home Directory (also known as the Home folder) in macOS is the designated repository for all files and folders specific to a user account. Located at /Users/[username], it contains standard subdirectories like Documents, Downloads, Pictures, and Music for user-created files. Crucially, it also houses the user's private Library folder (~/Library), which stores application settings, preferences, caches, and other data, effectively isolating one user's environment from others and the core operating system. This centralized structure is fundamental to macOS's multi-user architecture.

A. Spotlight: Spotlight is the indexing and search service integrated into macOS; it is not a directory for storing user files.

B. Time Machine: Time Machine is the backup utility for macOS. It creates copies of user data but is not the primary storage location.

C. Finder: Finder is the graphical file manager application for macOS, used to navigate and interact with the file system, not a storage folder itself.

1. Apple Inc. (Official Vendor Documentation). "What’s in your home folder on Mac?". macOS User Guide. Retrieved from Apple Support. This guide explicitly states, "Your home folder is named with your user name and includes subfolders for your desktop files, downloads, pictures, documents, movies, music, and any public files you want to share." This confirms the Home Directory's role as the central storage for a user's files.

Reference: support.apple.com/guide/mac-help/mchlp2603/mac

2. Apple Inc. (Official Vendor Documentation). "File System Programming Guide" (Archived). Mac OS X Developer Library. In the section "The File System Is Organized into Domains," it describes the "User" domain: "The User domain contains resources specific to the users of the system. The home directory for the current user is the root of this domain..."

Reference: Section: "The File System Is Organized into Domains," Subsection: "The User Domain." developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html

3. University of Texas at Austin (University Courseware). "Hardening Mac OS X 10.6 (Snow Leopard)". Information Security Office. This document, while for an older OS version, describes foundational principles that remain valid. It outlines the directory structure, stating, "The /Users directory contains the home directories for each user account on the system."

Reference: Page 10, Section: "File System." it.utexas.edu/sites/default/files/services/iso/hardening/HardeningMacOSX10.6.pdf

The ipconfig command is a standard command-line utility in Microsoft Windows operating systems. Its primary function is to display the current TCP/IP network configuration values for all network interface cards (NICs) on a system. An investigator can use ipconfig, particularly with the /all switch, to obtain detailed information such as the IP address, MAC address, default gateway, and DNS server details. This directly provides the status and configuration of the network interfaces as required by the investigator.

B. PsLoggedOn: This is a Sysinternals utility that shows which users are logged on to a system, either locally or remotely; it does not provide NIC status.

C. PsList: This Sysinternals tool lists detailed information about the processes currently running on a system, not network interface configurations.

D. ifconfig: This command provides network interface configuration details but is native to Unix-like operating systems (e.g., Linux, macOS), not the Windows environment specified in the question.

1. Microsoft Corporation. (2023). ipconfig. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig. This official documentation states, "Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings."

2. Stanford University. (2023). CS 144: Introduction to Computer Networking, Lab 0: Networking Warmup. In this lab, students are introduced to fundamental networking tools. The materials differentiate between ipconfig for Windows and ifconfig for Linux/macOS for the purpose of inspecting network interface configurations. (Reference to typical content in introductory networking labs at institutions like Stanford).

3. Orebaugh, A., & Ramirez, G. (2007). Ethereal Packet Sniffing. Syngress Publishing. In Chapter 2, "Network Analysis and the Protocol Hierarchy," the text describes basic network troubleshooting commands, identifying ipconfig as the primary tool for viewing IP configuration on Windows systems (p. 34).

In static malware analysis, one of the quickest ways to infer capability is to extract and review strings

embedded in a binary. Strings frequently reveal command-and-control domains/IPs, mutex names,

file paths, registry keys, user-agent values, suspicious commands (PowerShell/cmd), API names,

error messages, encryption markers, and configuration fragments. Investigators often use automated

utilities to extract these readable artifacts and export them to a text file for later triage, keyword

searching, and correlation with other evidence (network logs, endpoint telemetry, and threat intel).

Among the provided options, ResourcesExtract best matches this workflow. It is designed to extract

embedded content from executable files—particularly Windows PE resources—and can export

extracted textual items (including resource strings/strings tables and related embedded text) into

external files for analysis. This aligns with “performed a string search and saved all the identified

strings in a text file.”

The other choices do not fit: R-Drive Image is a disk imaging/backup tool; Ezvid is for screen

recording; and Snagit is for screenshots/screen capture. They do not perform automated extraction

of strings from malware binaries as a static-analysis step. Therefore, the correct answer is

ResourcesExtract (B).

A honeypot is a security mechanism specifically designed as a decoy to attract and trap malicious actors. It mimics a legitimate target on a network, appearing to contain valuable information or services to "bait" or "lure" attackers. The primary purpose of a honeypot is to be probed, attacked, and compromised in a controlled environment. This allows security professionals to study the attackers' tactics, techniques, and procedures (TTPs), gather intelligence on their tools, and identify their origins without exposing the actual production systems to risk. The scenario describes exactly this function.

A. Intrusion detection system: An IDS is a passive monitoring tool that detects and alerts on suspicious activity; it does not actively lure or bait attackers.

B. Firewall: A firewall is a preventative control that filters network traffic based on a set of security rules to block unauthorized access, not attract it.

D. Router: A router is a core networking device responsible for forwarding data packets between networks; it is not a security decoy system.

1. Provos, N. (2004). A Virtual Honeypot Framework. CITI Technical Report 03-1, University of Michigan. In Section 1 (Introduction), a honeypot is defined as "a resource that is intended to be attacked and compromised to gain information about an adversary." This aligns with the goal of studying attacker behavior.

2. Rowe, N. C., & Rrushi, J. (2016). Introduction to Cyberdeception. In SpringerBriefs in Cybersecurity. Springer, Cham. https://doi.org/10.1007/978-3-319-31615-51. Chapter 1, page 2, states, "Honeypots are fake computer systems or networks put on the Internet to lure and trap hackers." This directly supports the concept of using a device to "lure attackers."

3. Carnegie Mellon University, Software Engineering Institute. (2004). Using Honeynets to Protect a Network. Technical Note CMU/SEI-2004-TN-033. The abstract states, "The purpose of a honeynet is to gain information about the blackhat community," which is consistent with the scenario's objective to study and analyze attacker behavior.