CCD Malware Analysis & Reverse Engineering 3

Question 1

What is the primary goal of 'unpacking' a packed malware sample before analysis?

Accepted Answer

Recovering the original executable code hidden by a compression or encryption stub

Answer

Packers compress or encrypt the real payload and decompress it into memory at runtime; unpacking retrieves the original code for analysis.

Question 2

Which IDA Pro feature allows an analyst to rename automatically generated sub_XXXXXXXX function labels to meaningful names across all call sites?

Accepted Answer

Name propagation via 'n' hotkey rename

Answer

Pressing 'n' in IDA Pro renames a function or variable and propagates the new name to every reference within the database.

Question 3

A rootkit hides its process by unlinking its EPROCESS entry from the doubly-linked list. What is this technique called?

Accepted Answer

DKOM (Direct Kernel Object Manipulation)

Answer

DKOM modifies kernel objects such as the EPROCESS ActiveProcessLinks list to hide processes from tools that enumerate that list.

Question 4

When analyzing a malware sample in Ghidra, what does the 'Defined Data' window primarily help an analyst identify?

Accepted Answer

Strings, constants, and typed data structures the decompiler has recognized

Answer

The Defined Data window lists all data items Ghidra has typed or labeled, including strings and constants useful for rapid triage.

Question 5

Which network indicator is most useful for detecting beaconing behavior of a C2 implant?

Accepted Answer

Regular, periodic outbound connections with consistent intervals and low jitter

Answer

Beaconing implants check in with their C2 at predictable intervals, producing regular periodic spikes in network telemetry.

(CCD) Certified Cyber Defender Practice Test