GIAC Certification GIAC Malware Analyst 3

Question 1

In the x86 calling convention, which register holds the 32-bit integer return value of a function call?

Accepted Answer

EAX

Answer

EBX

Answer

ECX

Answer

EDX

Question 2

What is the result of the x86 instruction 'XOR EAX, EAX'?

Accepted Answer

EAX is set to zero

Answer

All bits in EAX are set to 1

Answer

EAX is copied to a shadow register

Answer

EAX is decremented by one

Question 3

What is the primary goal when a malware author uses a packer on their binary?

Accepted Answer

To compress and/or encrypt the payload so static signatures cannot match it

Answer

To increase the file size to bypass size-based scanning heuristics

Answer

To split the binary into benign-looking DLL components

Answer

To convert compiled code into an interpreted scripting language

Question 4

Which obfuscation category describes malware that rewrites its own code between infections while preserving its original functionality?

Accepted Answer

Polymorphic malware

Answer

Rootkit

Answer

DLL side-loading attack

Answer

Living-off-the-land technique

Question 5

Why does malware commonly create a named mutex on an infected host shortly after execution?

Accepted Answer

To mark the host as already infected and prevent duplicate installations

Answer

To lock victim files before encrypting them for ransomware

Answer

To secure its C2 communication channel against interception

Answer

To disable Windows Security Center from reporting its presence

Question 6

When shellcode is injected into a running process, which type of memory allocation is required for it to execute successfully?

Accepted Answer

Memory with Read-Write-Execute (RWX) permissions

Answer

Memory in the kernel address space

Answer

Read-only memory in the .rdata section

Answer

Stack memory used for local function variables

Question 7

What does the x86 CALL instruction do when executed?

Accepted Answer

Pushes the return address onto the stack and transfers execution to the target function

Answer

Pops the return address from the stack and resumes execution at the caller

Answer

Allocates a new stack frame without changing the instruction pointer

Answer

Pushes EBP onto the stack and saves the current frame pointer