CREST CREST Malware Analysis & Reverse Engineering

Question 1

What is the primary difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines code without execution; dynamic analysis observes behavior during execution

Answer

Static analysis inspects malware files (binary, strings, imports) without running them, while dynamic analysis executes the sample in a controlled environment to observe runtime behavior.

Question 2

Which tool is most commonly used for interactive disassembly and static reverse engineering of malware binaries?

Accepted Answer

IDA Pro / Ghidra

Answer

IDA Pro and Ghidra are industry-standard disassemblers that convert binary executables into assembly code for static analysis by malware analysts.

Question 3

What does 'packing' mean in the context of malware?

Accepted Answer

Compressing or encrypting malware to evade signature-based detection

Answer

Packing compresses, encrypts, or obfuscates malware code so that its true content is hidden from static analysis and signature-based antivirus.

Question 4

In malware analysis, what is a 'sandbox'?

Accepted Answer

An isolated virtualized environment for safely executing and observing malware behavior

Answer

A malware sandbox is an isolated virtual environment that executes suspicious files and automatically records system calls, network traffic, and file system changes.

Question 5

What is the purpose of analyzing the Import Address Table (IAT) of a Windows PE malware sample?

Accepted Answer

To understand which Windows API functions the malware calls, revealing its capabilities

Answer

The IAT lists Windows API functions a binary imports; analyzing it reveals capabilities like file system manipulation, registry access, network connectivity, and process injection.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Malware Analysis & Reverse Engineering