GREM In-Depth Executable Analysis 2

Question 1

When analyzing a PE file's Import Address Table (IAT), what does it signify if the IAT entries are all zeros before the executable is loaded?

Accepted Answer

The IAT is populated by the Windows loader at runtime with resolved function addresses

Answer

The IAT is initially filled with hint/name pointers or ordinals and is overwritten by the Windows loader with actual function addresses during process initialization.

Question 2

A malware sample creates a section named '.text' with both PAGE_EXECUTE_READWRITE permissions. Why is this anomalous from a static analysis perspective?

Accepted Answer

Legitimate .text sections are typically read-only and executable, not writable

Answer

Legitimate code sections are read-only and executable; writable AND executable permissions suggest runtime code modification, a common malware technique for unpacking or self-modification.

Question 3

During dynamic analysis, a malware sample calls VirtualAlloc with MEM_COMMIT | MEM_RESERVE followed immediately by a call to WriteProcessMemory targeting its own process. What technique is likely being employed?

Accepted Answer

In-memory unpacking or reflective loading

Answer

Allocating executable memory and writing code into it within the same process is the hallmark of in-memory unpacking, where compressed or encrypted payload is decoded at runtime.

Question 4

What does the 'e_lfanew' field in the DOS header of a PE file contain?

Accepted Answer

The file offset of the PE signature ('PE\0\0')

Answer

The e_lfanew field at offset 0x3C in the DOS header stores the file offset to the PE signature, which is the starting point for parsing the actual PE headers.

Question 5

An analyst observes that a PE binary's 'SizeOfImage' field in the Optional Header is significantly larger than the actual file size on disk. What does this typically indicate?

Accepted Answer

The image expands in memory due to section alignment and BSS-style uninitialized data

Answer

SizeOfImage reflects the total virtual memory footprint including aligned sections and zero-initialized data areas that don't need to be stored on disk.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM In-Depth Executable Analysis 2