CREST CREST Malware Analysis & Reverse Engineering

Question 1

What is the primary difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines code without execution; dynamic analysis observes behavior during execution

Answer

Static analysis runs malware in a sandbox; dynamic analysis reads binary files

Answer

Static analysis uses IDA Pro; dynamic analysis uses Wireshark only

Answer

Static is automated; dynamic is always manual

Question 2

Which tool is most commonly used for interactive disassembly and static reverse engineering of malware binaries?

Accepted Answer

IDA Pro / Ghidra

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 3

What does 'packing' mean in the context of malware?

Accepted Answer

Compressing or encrypting malware to evade signature-based detection

Answer

Bundling multiple exploits into one payload

Answer

Splitting malware into multiple files

Answer

Adding network propagation capabilities

Question 4

In malware analysis, what is a 'sandbox'?

Accepted Answer

An isolated virtualized environment for safely executing and observing malware behavior

Answer

A physical isolated network segment

Answer

A network honeypot designed to capture malware samples

Answer

A code repository for sharing malware indicators

Question 5

What is the purpose of analyzing the Import Address Table (IAT) of a Windows PE malware sample?

Accepted Answer

To understand which Windows API functions the malware calls, revealing its capabilities

Answer

To identify the compiler used to build the malware

Answer

To extract network packet captures

Answer

To find hardcoded encryption keys

Question 6

What technique do malware authors use to detect when their code is running inside a virtual machine or sandbox?

Accepted Answer

Anti-VM / sandbox evasion checks (CPUID, timing, artifact detection)

Answer

Code signing verification

Answer

Stack canary checks

Answer

ASLR probing