CCD Malware Analysis & Reverse Engineering 2

Question 1

Which technique do malware authors use to detect if their code is running inside a virtual machine by checking the CPUID instruction?

Accepted Answer

Anti-VM fingerprinting via CPUID hypervisor bit

Answer

Many malware samples query the CPUID hypervisor bit (ECX bit 31) to detect virtualized environments and alter or halt execution.

Question 2

During static analysis of a PE binary, which section typically contains the import address table (IAT)?

Accepted Answer

.idata

Answer

The .idata section of a PE file holds the import directory, which includes the Import Address Table resolved by the Windows loader.

Question 3

What is the purpose of 'code caves' in malware injection techniques?

Accepted Answer

Using unused regions of a legitimate PE file to insert shellcode

Answer

Code caves are blocks of null or unused bytes within a legitimate executable that malware repurposes to store and execute injected shellcode.

Question 4

Which Windows API function is most commonly abused by ransomware to enumerate and encrypt files on a victim system?

Accepted Answer

FindFirstFile / FindNextFile

Answer

Ransomware typically uses FindFirstFile/FindNextFile to recursively enumerate filesystem paths before encrypting each file.

Question 5

A malware sample uses the Windows registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' — what persistence mechanism does this represent?

Accepted Answer

Registry run key persistence

Answer

Writing to the Run registry key causes Windows to execute the specified binary each time the current user logs in.

(CCD) Certified Cyber Defender Practice Test