GCIA Malware Analysis and Behavioral Analysis 5

Question 1

A malware analyst detonates a sample and observes it enumerating HKLM\SOFTWARE\VMware, Inc.\VMware Tools. What is the malware checking for?

Accepted Answer

Virtual machine environment detection

Answer

Available disk space

Answer

Installed antivirus software

Answer

Network adapter configuration

Question 2

During behavioral analysis, a sample drops a DLL into C:\Windows\System32 with the same name as a legitimate DLL but slightly different (e.g., 'winscok.dll'). What technique is this?

Accepted Answer

Typosquatting/masquerading

Answer

DLL hijacking via search order

Answer

Reflective DLL injection

Answer

AppInit_DLLs abuse

Question 3

An analyst sees a malware sample making HTTP requests with a User-Agent string of 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)'. Why is this suspicious in 2024?

Accepted Answer

IE 6 on Windows XP is an anachronistic User-Agent unlikely to appear on modern systems

Answer

HTTP is not encrypted

Answer

The malware is using an IPv6 address

Answer

POST requests are not allowed with this agent

Question 4

Which behavioral indicator would most strongly suggest a rootkit is active on a Linux system during live forensics?

Accepted Answer

Discrepancies between /proc entries and kernel-level process lists

Answer

High CPU usage by a known process

Answer

Large log files in /var/log

Answer

Multiple SSH sessions from the same IP

Question 5

A GCIA analyst reviews Zeek (Bro) logs and finds a connection log showing a single long-duration session (12+ hours) with small periodic byte transfers. What C2 pattern does this match?

Accepted Answer

Beaconing with long sleep intervals

Answer

Fast flux C2

Answer

Peer-to-peer C2

Answer

Domain fronting

Question 6

When analyzing a .NET malware sample, which tool allows an analyst to decompile it back to near-original C# source code?

Accepted Answer

dnSpy or ILSpy

Answer

OllyDbg

Answer

IDA Pro

Answer

x64dbg

Question 7

A malware sample is observed spawning cmd.exe with the command 'powershell -EncodedCommand SQBFAFgA...'. What is the significance of the EncodedCommand flag?

Accepted Answer

It accepts a base64-encoded command to obfuscate the actual script from logging and detection

Answer

It compresses the PowerShell script for faster execution

Answer

It enables PowerShell remoting

Answer

It runs PowerShell with elevated privileges