GIAC Certification GIAC Malware Analyst

Question 1

Which free, open-source reverse engineering framework developed by the NSA is widely used for static disassembly and analysis of malware binaries?

Accepted Answer

Ghidra

Answer

Ghidra is an open-source reverse engineering suite released by the NSA that provides disassembly, decompilation, and scripting capabilities widely used in malware analysis.

Question 2

Which field in the PE file's COFF header specifies the target CPU architecture of the binary?

Accepted Answer

Machine field

Answer

The Machine field in the COFF header identifies the target processor type, such as 0x014c for x86 or 0x8664 for x64.

Question 3

Which PE section typically contains the executable machine code of a Windows binary?

Accepted Answer

.text

Answer

The .text section (sometimes called .code) holds the compiled machine instructions that the CPU executes when the program runs.

Question 4

What does the Import Address Table (IAT) in a PE file contain at runtime?

Accepted Answer

Resolved addresses of functions imported from external DLLs

Answer

The IAT is populated by the Windows loader at load time with the actual virtual addresses of imported DLL functions, enabling the binary to call them.

Question 5

Which Sysinternals utility quickly reveals hardcoded strings such as URLs, registry keys, or file paths embedded in a malware binary?

Accepted Answer

Strings

Answer

The Strings tool extracts printable ASCII and Unicode character sequences from binary files, often exposing indicators of compromise without executing the sample.

GIAC Certification Practice Test

GIAC Certification Practice Test

GIAC Certification GIAC Malware Analyst