CREST CREST Malware Analysis & Reverse Engineering 1 — Questions and Answers
Question 1: What is the primary difference between static and dynamic malware analysis?
- Static analysis runs malware in a sandbox; dynamic analysis reads binary files
- Static analysis examines code without execution; dynamic analysis observes behavior during execution (Correct answer)
- Static analysis uses IDA Pro; dynamic analysis uses Wireshark only
- Static is automated; dynamic is always manual
Correct answer: Static analysis examines code without execution; dynamic analysis observes behavior during execution
Static analysis inspects malware files (binary, strings, imports) without running them, while dynamic analysis executes the sample in a controlled environment to observe runtime behavior.
Question 2: Which tool is most commonly used for interactive disassembly and static reverse engineering of malware binaries?
- Wireshark
- IDA Pro / Ghidra (Correct answer)
- Metasploit
- Nmap
Correct answer: IDA Pro / Ghidra
IDA Pro and Ghidra are industry-standard disassemblers that convert binary executables into assembly code for static analysis by malware analysts.
Question 3: What does 'packing' mean in the context of malware?
- Bundling multiple exploits into one payload
- Compressing or encrypting malware to evade signature-based detection (Correct answer)
- Splitting malware into multiple files
- Adding network propagation capabilities
Correct answer: Compressing or encrypting malware to evade signature-based detection
Packing compresses, encrypts, or obfuscates malware code so that its true content is hidden from static analysis and signature-based antivirus.
Question 4: In malware analysis, what is a 'sandbox'?
- A physical isolated network segment
- An isolated virtualized environment for safely executing and observing malware behavior (Correct answer)
- A network honeypot designed to capture malware samples
- A code repository for sharing malware indicators
Correct answer: An isolated virtualized environment for safely executing and observing malware behavior
A malware sandbox is an isolated virtual environment that executes suspicious files and automatically records system calls, network traffic, and file system changes.
Question 5: What is the purpose of analyzing the Import Address Table (IAT) of a Windows PE malware sample?
- To identify the compiler used to build the malware
- To understand which Windows API functions the malware calls, revealing its capabilities (Correct answer)
- To extract network packet captures
- To find hardcoded encryption keys
Correct answer: To understand which Windows API functions the malware calls, revealing its capabilities
The IAT lists Windows API functions a binary imports; analyzing it reveals capabilities like file system manipulation, registry access, network connectivity, and process injection.
Question 6: What technique do malware authors use to detect when their code is running inside a virtual machine or sandbox?
- Code signing verification
- Anti-VM / sandbox evasion checks (CPUID, timing, artifact detection) (Correct answer)
- Stack canary checks
- ASLR probing
Correct answer: Anti-VM / sandbox evasion checks (CPUID, timing, artifact detection)
Malware uses anti-VM techniques such as checking CPUID instructions, VM-specific registry keys, VMware artifacts, or timing anomalies to detect sandbox environments and halt malicious activity.
CREST CREST Malware Analysis & Reverse Engineering 1
What is the primary difference between static and dynamic malware analysis?