Domain 3 · Blueprint topic (academy numbering) 3.3 · Chapter 7 of 20
Malware categories, behavior and safe analysis
About 6 minutes · EC-Council knowledge-exam blueprint v5.0; practical examination and training-version labels are separate
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Describe behavior before assigning a malware label.
Explore the anchors
Observe what the sample attempts to run.
Concept matching activity
Match this task or description to its concept:
Identify mechanisms that survive restart.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Assessment, defenses and evidence
- Malware evidence — deeper assessment study
Concepts and mechanisms
Malware is software used for harmful activity. Categories describe behavior or propagation rather than a guarantee of appearance: a virus attaches to another host artifact, a worm can propagate, a trojan presents misleading functionality, and ransomware can impair access or combine encryption with data theft. Fileless behavior can use legitimate tools or memory without a conventional malicious executable on disk.
An advanced persistent threat describes a sustained adversarial context, not one particular file type. Indicators such as hashes, domains or filenames can change and need context. A matching indicator does not establish every part of a campaign, while an unknown hash does not establish safety.
Assessment, defenses and evidence
Static analysis examines a sample without executing it; dynamic analysis observes behavior in a controlled environment. Treat samples as untrusted, restrict connectivity, protect analysis artifacts and document handling. A normal reporting laptop is not a safe substitute for an isolated analysis environment.
Defense includes prevention, patching, least privilege, application controls, monitored endpoints, segmentation and recoverable backups. A signature hit is one source of evidence; behavior, related identity events and business context also matter. Response should follow authorized containment and evidence procedures. Do not distribute live samples casually or erase original evidence to make an alert disappear.
Malware evidence — deeper assessment study
A Trojan describes deceptive delivery or functionality, a worm can propagate between systems and a virus attaches to other material for replication. Fileless behavior may use memory or legitimate system facilities; it does not mean there are no observable artifacts. A suspicious filename or unsigned file alone does not establish which category or intent applies.
Static analysis examines a sample without executing it; dynamic analysis observes behavior in controlled execution. Each has limits, including obfuscation and environment-sensitive behavior. Use approved containment, isolation, snapshots and handling procedures for actual malware work. In this academy, inspect fictional artifacts rather than executing samples. Match process, file, network and persistence observations before drawing a supported conclusion.
Worked example
A document launches an unexpected script interpreter. Analysts evaluate process relationships and related activity rather than assuming every script interpreter is malicious or that a document extension guarantees safety.
Check your understanding
How do static and dynamic analysis differ?
Show explanation
Static analysis examines artifacts without target execution. Dynamic analysis observes execution in a controlled environment. Each has limits, and neither makes ordinary production execution safe.
Apply this course’s topics in the CEH evidence workbench →
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.