GREM In-Depth Executable Analysis 2

Question 1

When analyzing a PE file's Import Address Table (IAT), what does it signify if the IAT entries are all zeros before the executable is loaded?

Accepted Answer

The IAT is populated by the Windows loader at runtime with resolved function addresses

Answer

The binary is corrupted and cannot be executed

Answer

The binary uses only statically linked libraries

Answer

The binary employs position-independent code exclusively

Question 2

A malware sample creates a section named '.text' with both PAGE_EXECUTE_READWRITE permissions. Why is this anomalous from a static analysis perspective?

Accepted Answer

Legitimate .text sections are typically read-only and executable, not writable

Answer

The .text section should never contain executable code

Answer

Section names beginning with a dot are reserved for the OS and cannot be used by malware

Answer

PAGE_EXECUTE_READWRITE is the default permission for all PE sections

Question 3

During dynamic analysis, a malware sample calls VirtualAlloc with MEM_COMMIT | MEM_RESERVE followed immediately by a call to WriteProcessMemory targeting its own process. What technique is likely being employed?

Accepted Answer

In-memory unpacking or reflective loading

Answer

Heap spraying

Answer

Stack pivoting

Answer

Return-oriented programming (ROP)

Question 4

What does the 'e_lfanew' field in the DOS header of a PE file contain?

Accepted Answer

The file offset of the PE signature ('PE\0\0')

Answer

The size of the DOS stub program

Answer

The preferred load address of the image

Answer

The entry point relative virtual address

Question 5

An analyst observes that a PE binary's 'SizeOfImage' field in the Optional Header is significantly larger than the actual file size on disk. What does this typically indicate?

Accepted Answer

The image expands in memory due to section alignment and BSS-style uninitialized data

Answer

The file is truncated and damaged

Answer

The binary has been digitally signed with a large certificate

Answer

The binary imports more functions than it actually uses

Question 6

When reversing a 64-bit Windows binary, which calling convention is used for the first four integer or pointer arguments?

Accepted Answer

Microsoft x64 — first four args in RCX, RDX, R8, R9 with shadow space reserved

Answer

cdecl — all arguments pushed on the stack right-to-left

Answer

stdcall — all arguments pushed on the stack left-to-right

Answer

fastcall — first two args in ECX and EDX only

Question 7

A packed PE file's entry point disassembles to a short stub that eventually jumps to an address computed at runtime. What term describes the location of the original program's entry point after unpacking?

Accepted Answer

Original Entry Point (OEP)

Answer

Virtual Entry Point (VEP)

Answer

Dynamic Resolution Address (DRA)

Answer

Relocated Base Pointer (RBP)