GIAC Certification GIAC Malware Analyst 3

Question 1

In the x86 calling convention, which register holds the 32-bit integer return value of a function call?

Accepted Answer

EAX

Answer

The cdecl, stdcall, and fastcall x86 calling conventions all designate EAX as the register that stores the integer or pointer return value from a called function.

Question 2

What is the result of the x86 instruction 'XOR EAX, EAX'?

Accepted Answer

EAX is set to zero

Answer

XOR'ing any value with itself always yields zero because each bit cancels its matching bit, making 'XOR EAX, EAX' an efficient two-byte way to zero out a register.

Question 3

What is the primary goal when a malware author uses a packer on their binary?

Accepted Answer

To compress and/or encrypt the payload so static signatures cannot match it

Answer

Packers compress and/or encrypt the real malware payload and attach a small stub that decompresses or decrypts it at runtime, defeating static antivirus signatures.

Question 4

Which obfuscation category describes malware that rewrites its own code between infections while preserving its original functionality?

Accepted Answer

Polymorphic malware

Answer

Polymorphic malware mutates its code body (through encryption, instruction substitution, or reordering) each time it replicates, producing unique binary signatures that defeat static detection.

Question 5

Why does malware commonly create a named mutex on an infected host shortly after execution?

Accepted Answer

To mark the host as already infected and prevent duplicate installations

Answer

A named mutex acts as a unique infection marker; if a second instance of the malware runs and finds the mutex already exists, it exits to avoid duplicate infections that could cause instability.

GIAC Certification Practice Test

GIAC Certification Practice Test

GIAC Certification GIAC Malware Analyst 3