Ethical Hacking Malware Threats Syllabus

Malware Threats syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Malware Threats in Ethical Hacking, not a summary of it.

1. 1

   Types of Malware

   4 topics

   • Viruses
   • Worms
   • Trojans
   • Ransomware
2. 2

   Malware Analysis

   3 topics

   • Static Analysis
   • Dynamic Analysis
   • Sandboxing
3. 3

   Anti-malware Tools

   3 topics

   • Antivirus Software
   • Anti-spyware Tools
   • Endpoint Protection Solutions

Malware Threats flashcards for Ethical Hacking

22 of 50 cards from the Malware Threats deck — real questions with worked answers.

1. What is a computer virus?

   A malicious program that attaches itself to a legitimate host file or program and requires user action (running the host) to execute and replicate, inserting copies of its code into other files.

2. How does a worm differ fundamentally from a virus?

   A worm is self-replicating and self-propagating; it spreads across networks on its own without needing a host file or user interaction, whereas a virus needs a host and user execution.

3. What is a Trojan (Trojan horse)?

   Malware disguised as a legitimate or desirable program that tricks the user into running it; it does not self-replicate but delivers a hidden malicious payload (e.g., a backdoor).

4. What is ransomware?

   Malware that encrypts or blocks access to a victim's data or system and demands a ransom payment (often in cryptocurrency) in exchange for the decryption key or restored access.

5. Name the two broad categories of malware analysis and their core distinction.

   Static analysis examines the code/file without executing it; dynamic analysis runs the sample in a controlled environment and observes its behavior.

6. What is a sandbox in the context of malware analysis?

   An isolated, controlled virtual environment where suspicious code can be executed and observed safely without risk to the host system or production network.

7. What is the primary purpose of antivirus software?

   To detect, quarantine, and remove malware from a system using techniques such as signature matching, heuristics, and behavioral monitoring.

8. What is anti-spyware software designed to counter?

   Spyware and similar programs that covertly gather user information (keystrokes, browsing habits, credentials); anti-spyware detects and removes these tracking/monitoring programs.

9. What does an Endpoint Protection Platform (EPP) provide?

   An integrated security suite on endpoints combining antivirus/anti-malware, firewall, device control, and often EDR to prevent, detect, and respond to threats on each device.

10. What is the difference between EPP and EDR?

    EPP focuses on prevention (blocking known threats at the endpoint); EDR (Endpoint Detection and Response) focuses on continuous monitoring, detection, investigation, and response to threats that bypass prevention.

11. What is a polymorphic virus?

    A virus that changes its code (via encryption with a mutating decryptor) on each infection so its signature differs, evading signature-based detection while keeping the same underlying functionality.

12. What is a metamorphic virus and how does it differ from a polymorphic virus?

    A metamorphic virus rewrites its own entire code body each generation (no fixed decryptor), whereas a polymorphic virus keeps a constant underlying body that is merely re-encrypted with a changing decryptor.

13. What is a macro virus?

    A virus written in the macro language of an application (e.g., VBA in Microsoft Office documents) that executes when the infected document is opened and macros run.

14. What is a boot sector virus?

    A virus that infects the Master Boot Record (MBR) or boot sector of a disk so it loads into memory before the operating system, gaining control early in the boot process.

15. What is signature-based detection?

    An antivirus technique that identifies malware by matching files against a database of known malware signatures (unique byte patterns or hashes). It cannot detect novel/zero-day malware.

16. What is heuristic-based detection?

    A detection method that flags malware by analyzing code structure and suspicious characteristics or by running it in emulation, enabling detection of unknown or variant malware not in the signature database.

17. What is behavior-based (behavioral) detection?

    A method that monitors a program's actions at runtime (file, registry, network, process activity) and flags it as malicious if it exhibits harmful behavior, regardless of signature.

18. What is a logic bomb?

    Malicious code embedded in a program that lies dormant until a specific trigger condition is met (a date, event, or action), at which point it executes its payload.

19. What is a rootkit?

    Malware designed to gain and maintain privileged (root/admin) access while hiding its presence and other malware from the OS and security tools, often by modifying kernel or system components.

20. What is a backdoor?

    A method or piece of code that bypasses normal authentication to give an attacker covert, persistent remote access to a system; commonly installed by a Trojan.

21. Distinguish crypto ransomware from locker ransomware.

    Crypto ransomware encrypts the victim's files while leaving the system usable; locker ransomware locks the user out of the entire device/system but usually does not encrypt individual files.

22. What is the WannaCry ransomware notable for?

    A 2017 ransomware worm that spread using the EternalBlue SMB exploit, self-propagating across networks and encrypting files—combining worm propagation with ransomware payload.

See more Malware Threats flashcards →

Planning Malware Threats for Ethical Hacking

Malware Threats (Ethical Hacking) FAQ