GCIA Malware Analysis and Behavioral Analysis 4

Question 1

A GCIA analyst examining a memory dump uses Volatility's 'malfind' plugin and finds executable memory regions with MZ headers in unusual processes. What does this indicate?

Accepted Answer

Code injection has likely occurred in that process

Answer

MZ headers (PE file markers) found in non-executable or anonymous memory regions strongly indicate injected code such as a reflective DLL or shellcode.

Question 2

Which sandbox evasion technique involves malware checking if the number of running processes is below a threshold before executing its payload?

Accepted Answer

Process count enumeration

Answer

Sandboxes often run fewer processes than a real user system, so malware enumerating processes and aborting if the count is too low is an environment detection technique.

Question 3

During analysis, a malware sample is observed calling Sleep(300000) early in execution. What evasion technique does this represent?

Accepted Answer

Timing-based sandbox evasion

Answer

Sleeping for several minutes causes many automated sandboxes with short analysis windows to timeout and miss the malicious payload.

Question 4

A reverse engineer finds a function that XORs each byte of a string with 0x41 before use. What obfuscation technique is this?

Accepted Answer

Single-byte XOR string obfuscation

Answer

XORing each byte with a constant key is the simplest form of string obfuscation, used to hide indicators from static string analysis.

Question 5

An analyst observes a malware sample creating a Windows service with 'sc.exe create' and setting the start type to 'auto'. What is the malware doing?

Accepted Answer

Creating a persistence mechanism via auto-start service

Answer

Creating an auto-start Windows service ensures the malware component launches automatically on every system reboot, providing persistent access.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Malware Analysis and Behavioral Analysis 4