GREM Analyzing Web-Based Malware 2

Question 1

When analyzing a malicious JavaScript file, you notice it uses `document.write(unescape('%3C%73%63%72%69%70%74%3E...'))`. What technique is this?

Accepted Answer

URL encoding obfuscation to hide embedded script tags

Answer

Base64 encoding to compress payload size

Answer

XOR encryption to evade static signatures

Answer

HTML entity encoding to bypass input filters

Question 2

A drive-by download exploit checks `navigator.userAgent` and `navigator.plugins` before delivering a payload. What is the primary purpose of this reconnaissance?

Accepted Answer

Fingerprinting the victim browser to select the most effective exploit

Answer

Avoiding detection by sandbox environments with no plugins

Answer

Collecting user data for phishing credential theft

Answer

Verifying the page loaded correctly before executing

Question 3

During PCAP analysis of a malware infection, you observe repeated HTTP GET requests to random-looking subdomains of a legitimate domain (e.g., `a1b2c3.example.com`). What C2 mechanism does this indicate?

Accepted Answer

DNS tunneling exfiltrating data via subdomain labels

Answer

Domain Generation Algorithm (DGA) using a legitimate domain as a base

Answer

Fast-flux DNS technique rotating IP addresses

Answer

CDN-based C2 using legitimate hosting infrastructure

Question 4

You are examining a malicious PDF that triggers an exploit when opened. Which tool would best help you extract and analyze embedded JavaScript within the PDF?

Accepted Answer

pdf-parser.py or peepdf

Answer

Wireshark with SSL decryption

Answer

strings and grep

Answer

OllyDbg with PDF plugin

Question 5

A web-based malware sample uses `eval(String.fromCharCode(118,97,114,...))` to execute code. What is the best first step to analyze the payload?

Accepted Answer

Replace `eval` with `console.log` and run in a browser console to reveal the decoded string

Answer

Disassemble the JavaScript with IDA Pro

Answer

Capture network traffic with Wireshark before execution

Answer

Search VirusTotal for the CharCode sequence

Question 6

An exploit kit landing page dynamically loads different exploit modules based on detected software. Which HTTP response header would most commonly be used to prevent caching of these pages to ensure fresh fingerprinting?

Accepted Answer

Cache-Control: no-store, no-cache

Answer

Content-Security-Policy: default-src 'none'

Answer

X-Frame-Options: DENY

Answer

Strict-Transport-Security: max-age=0

Question 7

When analyzing a malicious SWF (Flash) file, which tool allows you to decompile it to ActionScript for static analysis?

Accepted Answer

JPEXS Free Flash Decompiler (FFDec)

Answer

OllyDbg with Flash plugin

Answer

Volatility with SWF module

Answer

Scapy with SWF dissector