CCD Malware Analysis & Reverse Engineering 3 — Questions and Answers
Question 1: What is the primary goal of 'unpacking' a packed malware sample before analysis?
- Removing digital signatures from the binary
- Recovering the original executable code hidden by a compression or encryption stub (Correct answer)
- Disabling anti-debugging checks in the loader
- Extracting embedded network certificates
Correct answer: Recovering the original executable code hidden by a compression or encryption stub
Packers compress or encrypt the real payload and decompress it into memory at runtime; unpacking retrieves the original code for analysis.
Question 2: Which IDA Pro feature allows an analyst to rename automatically generated sub_XXXXXXXX function labels to meaningful names across all call sites?
- Structure offset propagation
- Local type import
- Name propagation via 'n' hotkey rename (Correct answer)
- Compiler type recovery
Correct answer: Name propagation via 'n' hotkey rename
Pressing 'n' in IDA Pro renames a function or variable and propagates the new name to every reference within the database.
Question 3: A rootkit hides its process by unlinking its EPROCESS entry from the doubly-linked list. What is this technique called?
- Process hollowing
- DKOM (Direct Kernel Object Manipulation) (Correct answer)
- Heaven's Gate
- Reflective DLL injection
Correct answer: DKOM (Direct Kernel Object Manipulation)
DKOM modifies kernel objects such as the EPROCESS ActiveProcessLinks list to hide processes from tools that enumerate that list.
Question 4: When analyzing a malware sample in Ghidra, what does the 'Defined Data' window primarily help an analyst identify?
- Cross-references between functions
- Strings, constants, and typed data structures the decompiler has recognized (Correct answer)
- Entropy values of binary sections
- Network traffic generated at runtime
Correct answer: Strings, constants, and typed data structures the decompiler has recognized
The Defined Data window lists all data items Ghidra has typed or labeled, including strings and constants useful for rapid triage.
Question 5: Which network indicator is most useful for detecting beaconing behavior of a C2 implant?
- Unusually large DNS TXT records
- Regular, periodic outbound connections with consistent intervals and low jitter (Correct answer)
- TLS handshakes using self-signed certificates
- HTTP 404 responses from the target server
Correct answer: Regular, periodic outbound connections with consistent intervals and low jitter
Beaconing implants check in with their C2 at predictable intervals, producing regular periodic spikes in network telemetry.
Question 6: What does a malware sample accomplish when it calls 'NtUnmapViewOfSection' followed by 'VirtualAllocEx' and 'WriteProcessMemory' on a target process?
- DLL side-loading
- Process hollowing (Correct answer)
- Atom bombing
- Thread execution hijacking
Correct answer: Process hollowing
Process hollowing unmaps a legitimate process's code, then writes malicious code into the vacated address space before resuming execution.
Question 7: In a YARA rule, what does the 'filesize' condition keyword allow an analyst to do?
- Hash the file and compare to a known-bad digest
- Restrict matches to files within a specified byte size range (Correct answer)
- Enumerate sections of a PE and check their sizes
- Compare compile timestamps across samples
Correct answer: Restrict matches to files within a specified byte size range
The 'filesize' keyword limits YARA rule matches to files whose total size satisfies the given comparison, reducing false positives.
CCD Malware Analysis & Reverse Engineering 3
What is the primary goal of 'unpacking' a packed malware sample before analysis?