GIAC Certification GIAC Malware Analyst

Question 1

Which free, open-source reverse engineering framework developed by the NSA is widely used for static disassembly and analysis of malware binaries?

Accepted Answer

Ghidra

Answer

Wireshark

Answer

Process Monitor

Answer

Volatility

Question 2

Which field in the PE file's COFF header specifies the target CPU architecture of the binary?

Accepted Answer

Machine field

Answer

SizeOfOptionalHeader

Answer

Characteristics field

Answer

AddressOfEntryPoint

Question 3

Which PE section typically contains the executable machine code of a Windows binary?

Accepted Answer

.text

Answer

.data

Answer

.rdata

Answer

.rsrc

Question 4

What does the Import Address Table (IAT) in a PE file contain at runtime?

Accepted Answer

Resolved addresses of functions imported from external DLLs

Answer

Names of functions exported by the binary

Answer

Printable strings embedded in the binary

Answer

Addresses of functions defined locally within the file

Question 5

Which Sysinternals utility quickly reveals hardcoded strings such as URLs, registry keys, or file paths embedded in a malware binary?

Accepted Answer

Strings

Answer

Process Hacker

Answer

Regshot

Answer

Autoruns

Question 6

High entropy (near 8.0 bits per byte) in a PE section most likely indicates what characteristic of that section?

Accepted Answer

The section is compressed or encrypted

Answer

The section contains debug symbols

Answer

The section holds read-only constant data

Answer

The section contains bitmap or icon resources

Question 7

What is the primary advantage of performing static analysis on a malware sample before executing it?

Accepted Answer

The sample can be examined for IOCs without the risk of running malicious code

Answer

Network traffic generated by the malware can be captured in real time

Answer

The exact processes created by the malware at runtime are revealed

Answer

Anti-analysis techniques used by the malware are automatically bypassed