Malware

Question 1

Metamorphic virus

Answer 1

Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus)

Question 2

Grayware

Answer 2

Software that isn’t benign nor malicious and tends to behave improperly without serious consequences

Question 3

Rootkit

Answer 3

Software designed to gain administrative level control over a system without detection

DLL injection is commonly used by rootkits to maintain their persistent control

Rootkits are activated before booting the operating system and are difficult to detect

Question 4

Rootkits: DLL Injection

Answer 4

Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime

Occurs by the use of a shim

Question 5

Rootkits: Driver Manipulation

Answer 5

An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level

Occurs by the use of a shim

Question 6

Shim

Answer 6

A piece of software code that is placed between two components to intercept calls and redirect them

Malware authors can use shims to get around security features (like UAC) or to elevate privileges

Windows compatibility mode is an example of a shim

Question 7

Fileless Virus

Answer 7

Malware only running in memory

No artifacts left on the endpoint that can be detected with traditional file type-based tools

Question 8

Refactoring

Answer 8

The process of rewriting the internal processing of the code, without changing its external behavior.

Question 9

Boot sector/Boot sector virus

Answer 9

A boot sector virus is malware that infects the computer storage sector where startup files are found. The boot sector contains all the files required to start the operating system (OS) and other bootable programs.

Question 10

Macro

Answer 10

Virus embedded into a document and is executed when the document is opened by the user

Question 11

Program

Answer 11

Program viruses infect an executable or application

Question 12

Multipartite

Answer 12

Virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer

Question 13

encrypted virus

Answer 13

An encrypted virus is defined as a computer virus/malware that is capable of encrypting its payload to make its detection hard.

Question 14

Polymorphic

Answer 14

Advanced version of an encrypted virus that changes itself every time it is executed by altering the decryption module to avoid detection