CCD Malware Analysis & Reverse Engineering 2 — Questions and Answers
Question 1: Which technique do malware authors use to detect if their code is running inside a virtual machine by checking the CPUID instruction?
- Heap spray detection
- Anti-VM fingerprinting via CPUID hypervisor bit (Correct answer)
- Stack canary inspection
- Return-oriented programming
Correct answer: Anti-VM fingerprinting via CPUID hypervisor bit
Many malware samples query the CPUID hypervisor bit (ECX bit 31) to detect virtualized environments and alter or halt execution.
Question 2: During static analysis of a PE binary, which section typically contains the import address table (IAT)?
- .text
- .rsrc
- .idata (Correct answer)
- .reloc
Correct answer: .idata
The .idata section of a PE file holds the import directory, which includes the Import Address Table resolved by the Windows loader.
Question 3: What is the purpose of 'code caves' in malware injection techniques?
- Storing encrypted strings in the heap
- Using unused regions of a legitimate PE file to insert shellcode (Correct answer)
- Hooking system calls via inline patching
- Redirecting TLS callbacks to malicious code
Correct answer: Using unused regions of a legitimate PE file to insert shellcode
Code caves are blocks of null or unused bytes within a legitimate executable that malware repurposes to store and execute injected shellcode.
Question 4: Which Windows API function is most commonly abused by ransomware to enumerate and encrypt files on a victim system?
- CreateFileMapping
- FindFirstFile / FindNextFile (Correct answer)
- VirtualAllocEx
- NtCreateThreadEx
Correct answer: FindFirstFile / FindNextFile
Ransomware typically uses FindFirstFile/FindNextFile to recursively enumerate filesystem paths before encrypting each file.
Question 5: A malware sample uses the Windows registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' — what persistence mechanism does this represent?
- Scheduled task persistence
- Service-based persistence
- Registry run key persistence (Correct answer)
- DLL search order hijacking
Correct answer: Registry run key persistence
Writing to the Run registry key causes Windows to execute the specified binary each time the current user logs in.
Question 6: In dynamic malware analysis, what does the term 'behavioral baselining' refer to?
- Hashing all imported functions before execution
- Recording normal system activity before running the sample to identify deviations (Correct answer)
- Disabling ASLR so addresses are predictable
- Dumping process memory after execution completes
Correct answer: Recording normal system activity before running the sample to identify deviations
Behavioral baselining captures a clean system snapshot so that any changes caused by the malware can be isolated and attributed.
Question 7: Which obfuscation method splits a string into individual character codes that are concatenated at runtime to evade static string scanning?
- XOR encryption
- Base64 encoding
- String concatenation obfuscation (Correct answer)
- Polymorphic engine mutation
Correct answer: String concatenation obfuscation
Splitting strings into character-code arrays that are joined at runtime prevents signature-based tools from matching the complete plaintext string.
CCD Malware Analysis & Reverse Engineering 2
Which technique do malware authors use to detect if their code is running inside a virtual machine by checking the CPUID instruction?