Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

A forensic analyst investigating an unexpected data wipe on a critical financial server discovers an obfuscated script embedded within a routine system backup routine. The script performs no malicious activity during normal execution; however, it regularly queries the enterprise LDAP directory. Inspection reveals that if a specific senior database administrator's account status transitions to 'Inactive' or 'Disabled', the script triggers an automated payload that executes a multi-pass overwrite of disk sectors and purges transaction logs. Which of the following malware classifications best describes this threat based on its operational behavior?

  1. Logic bombAnswer
  2. B
    Trojan
  3. C
    Worm
  4. D
    Rootkit

Answer

The threat is classified as a logic bomb because it remains dormant within a legitimate routine until a specific predefined logical condition (an account status change in LDAP) triggers the execution of its destructive payload.
The correct answer identifies the malware as a logic bomb. Logic bombs consist of malicious code snippets embedded into legitimate applications or scripts that lie dormant until a specific condition or event occurs—such as a specific date, time, file creation, or in this case, an administrator's account being marked as disabled in LDAP. Once triggered, the code executes its malicious payload.

Step-by-Step Solution

1
Analyze the observed behavior and persistence mechanism of the embedded script.
Identified that the code runs inside a standard backup routine without causing harm during ordinary system operation.
Establishing baseline execution behavior helps distinguish active background attacks from dormant conditional threats.
2
Evaluate the activation criteria specified within the payload logic.
Determined that payload execution depends directly on the LDAP status change of a targeted administrator account.
Dormancy combined with conditional event-based execution is the defining characteristic of a logical trigger.
3
Correlate the activation mechanism with formal malware definitions.
Concluded that code executing destructive actions exclusively upon reaching a designated logical state matches the classification of a logic bomb.
Differentiating malware by activation vector (propagation vs. masking vs. conditional triggers) yields the precise security classification.

Key Concept

Logic Bomb Identification and Operational Triggers
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic