GIAC Certification GIAC Malware Analyst 2

Question 1

What is the primary purpose of executing a malware sample in a sandbox environment?

Accepted Answer

To safely observe the malware's behavioral artifacts in an isolated system

Answer

A sandbox provides an isolated, instrumented environment where malware can run freely, revealing its file system, registry, network, and process activity without endangering real systems.

Question 2

Which anti-analysis technique involves malware querying VM-specific registry keys or using the CPUID hypervisor bit to alter its behavior?

Accepted Answer

Virtual machine detection

Answer

Malware checks for virtualization artifacts such as registry keys (e.g., HKLM\SOFTWARE\VMware, Inc.) or the CPUID hypervisor bit to determine if it is running in a sandbox and behave differently.

Question 3

What is the primary objective of process injection techniques used by malware?

Accepted Answer

To execute malicious code inside the address space of a legitimate, trusted process

Answer

Process injection places malicious code or DLLs within a trusted process's memory, allowing the malware to inherit its privileges and evade process-based security monitoring.

Question 4

Which dynamic analysis tool intercepts and logs Windows API calls made by a running malware sample in real time?

Accepted Answer

API Monitor

Answer

API Monitor hooks and records every Windows API function call with its arguments and return values, giving analysts a detailed view of what the malware does at the API level during execution.

Question 5

Which indicator most strongly suggests a process is a victim of process hollowing?

Accepted Answer

The in-memory image of a process does not match the binary on disk

Answer

Process hollowing replaces a suspended legitimate process's code with malicious code, causing a definitive mismatch between the on-disk PE file and what resides in the process's memory.

GIAC Certification Practice Test

GIAC Certification Practice Test

GIAC Certification GIAC Malware Analyst 2