GCIA Malware Analysis and Behavioral Analysis 4

Question 1

A GCIA analyst examining a memory dump uses Volatility's 'malfind' plugin and finds executable memory regions with MZ headers in unusual processes. What does this indicate?

Accepted Answer

Code injection has likely occurred in that process

Answer

The process loaded a legitimate DLL

Answer

The process is compiled with ASLR disabled

Answer

The system has a driver signing violation

Question 2

Which sandbox evasion technique involves malware checking if the number of running processes is below a threshold before executing its payload?

Accepted Answer

Process count enumeration

Answer

Timing-based evasion

Answer

Environment artifact detection

Answer

Anti-debugging via IsDebuggerPresent

Question 3

During analysis, a malware sample is observed calling Sleep(300000) early in execution. What evasion technique does this represent?

Accepted Answer

Timing-based sandbox evasion

Answer

Anti-debugging

Answer

DLL injection

Answer

Heap spray

Question 4

A reverse engineer finds a function that XORs each byte of a string with 0x41 before use. What obfuscation technique is this?

Accepted Answer

Single-byte XOR string obfuscation

Answer

Base64 encoding

Answer

RC4 encryption

Answer

AES encryption

Question 5

An analyst observes a malware sample creating a Windows service with 'sc.exe create' and setting the start type to 'auto'. What is the malware doing?

Accepted Answer

Creating a persistence mechanism via auto-start service

Answer

Establishing network connectivity

Answer

Installing a keylogger driver

Answer

Configuring firewall rules

Question 6

Which Volatility plugin would best help identify hidden or unlinked processes that malware has concealed from the Windows process list?

Accepted Answer

psscan

Answer

pslist

Answer

pstree

Answer

dlllist

Question 7

A malware sample communicates with its C2 server using HTTPS with a self-signed certificate. Why might this complicate network-based detection?

Accepted Answer

Traffic is encrypted, hiding the payload from signature-based IDS inspection

Answer

HTTPS traffic is illegal to inspect without a warrant

Answer

Self-signed certificates cause the malware to fail

Answer

HTTPS only works on port 443