GREM Analyzing Web-Based Malware 2

Question 1

When analyzing a malicious JavaScript file, you notice it uses `document.write(unescape('%3C%73%63%72%69%70%74%3E...'))`. What technique is this?

Accepted Answer

URL encoding obfuscation to hide embedded script tags

Answer

Using `unescape()` with percent-encoded characters is a classic obfuscation technique to hide script injection strings from static analysis.

Question 2

A drive-by download exploit checks `navigator.userAgent` and `navigator.plugins` before delivering a payload. What is the primary purpose of this reconnaissance?

Accepted Answer

Fingerprinting the victim browser to select the most effective exploit

Answer

Browser fingerprinting via navigator properties allows exploit kits to serve targeted exploits matched to the specific browser version and installed plugins.

Question 3

During PCAP analysis of a malware infection, you observe repeated HTTP GET requests to random-looking subdomains of a legitimate domain (e.g., `a1b2c3.example.com`). What C2 mechanism does this indicate?

Accepted Answer

DNS tunneling exfiltrating data via subdomain labels

Answer

Random-looking subdomain queries are a hallmark of DNS tunneling, where data is encoded into DNS subdomain labels to exfiltrate information or receive commands.

Question 4

You are examining a malicious PDF that triggers an exploit when opened. Which tool would best help you extract and analyze embedded JavaScript within the PDF?

Accepted Answer

pdf-parser.py or peepdf

Answer

Tools like pdf-parser.py and peepdf are designed specifically to extract embedded streams, JavaScript, and objects from malicious PDF files.

Question 5

A web-based malware sample uses `eval(String.fromCharCode(118,97,114,...))` to execute code. What is the best first step to analyze the payload?

Accepted Answer

Replace `eval` with `console.log` and run in a browser console to reveal the decoded string

Answer

Replacing `eval` with a logging function safely reveals the decoded payload string without executing potentially harmful code.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Analyzing Web-Based Malware 2