GCIA Malware Analysis and Behavioral Analysis 3

Question 1

Which tool is commonly used on Windows to monitor registry, file system, and process activity during dynamic malware analysis?

Accepted Answer

Process Monitor (ProcMon)

Answer

Volatility

Answer

Wireshark

Answer

IDA Pro

Question 2

A malware binary's strings reveal 'VirtualProtect', 'LoadLibraryA', and 'GetProcAddress' but few other imports. What does this import pattern suggest?

Accepted Answer

The binary is packed or uses dynamic API resolution

Answer

The binary is compiled in Go

Answer

The binary is a .NET assembly

Answer

The binary uses only legitimate Windows APIs

Question 3

During process hollowing analysis, which action occurs AFTER the attacker creates a suspended legitimate process?

Accepted Answer

The attacker unmaps the legitimate process's memory and maps malicious code

Answer

The attacker calls CreateRemoteThread

Answer

The attacker patches the IAT of the target process

Answer

The attacker injects a reflective DLL

Question 4

An IDS alert fires on traffic containing 'GET /search?q=aW5mb3N0ZWFsZXI=' to a known-bad IP. What should an analyst suspect about the query parameter?

Accepted Answer

Base64-encoded C2 command or data

Answer

SQL injection attempt

Answer

URL path traversal

Answer

XSS payload

Question 5

What is the primary difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines the binary without executing it; dynamic analysis observes runtime behavior

Answer

Static analysis requires a sandbox; dynamic analysis does not

Answer

Static analysis is only for scripts; dynamic analysis is for binaries

Answer

Dynamic analysis cannot detect network indicators

Question 6

A malware sample opens a raw socket and crafts ICMP echo request packets containing 128 bytes of non-standard payload data. What is this behavior consistent with?

Accepted Answer

ICMP covert channel for C2 communication

Answer

ARP poisoning

Answer

Network scanning activity

Answer

Ping of death attack

Question 7

When performing memory forensics on a compromised system, an analyst finds a process with no corresponding executable on disk. What technique does this most likely indicate?

Accepted Answer

Fileless malware executing entirely in memory

Answer

A corrupted Windows installation

Answer

A process created by the kernel

Answer

A containerized application