GREM Malicious Executable Analysis 2

Question 1

When examining a PE file's Import Address Table (IAT), which API combination most strongly suggests process injection capability?

Accepted Answer

OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread

Answer

CreateFile, ReadFile, WriteFile, CloseHandle

Answer

RegOpenKeyEx, RegSetValueEx, RegCloseKey, RegDeleteKey

Answer

socket, connect, send, recv

Question 2

A malware sample's section header shows a section named '.text' with both IMAGE_SCN_MEM_EXECUTE and IMAGE_SCN_MEM_WRITE flags set. Why is this suspicious?

Accepted Answer

Executable sections are normally read-only, not writable, indicating possible self-modifying or packed code

Answer

The .text section should always be larger than 4KB

Answer

Write permissions on .text cause Windows to disable ASLR for that module

Answer

This combination triggers automatic quarantine by the Windows loader

Question 3

During dynamic analysis, a malware sample calls SetWindowsHookEx with idHook set to WH_KEYBOARD_LL. What is the most likely purpose?

Accepted Answer

Keylogging to capture user keystrokes system-wide

Answer

Injecting code into all running processes

Answer

Modifying network packets before transmission

Answer

Hiding the malware's window from the taskbar

Question 4

A malicious DLL exports a function named 'DllRegisterServer'. What evasion or persistence technique does this support?

Accepted Answer

Masquerading as a COM server DLL to enable regsvr32-based execution and persistence

Answer

Injecting into the Windows registry hive directly

Answer

Bypassing UAC by hooking the registration service

Answer

Establishing a reverse shell disguised as COM traffic

Question 5

In IDA Pro, you notice a function that XORs a buffer with a single-byte key and then calls a Windows API. What is the best first step to reveal the buffer's contents?

Accepted Answer

Identify the key byte and write a script to XOR-decode the buffer statically

Answer

Rename the function to 'decrypt_stub' and continue analysis

Answer

Check if the function is present in the IAT

Answer

Search for the buffer in the PE's resource section

Question 6

A sample creates a mutex named 'Global\SystemMutex2026' early in execution. From a reverse engineering perspective, why do analysts extract this value?

Accepted Answer

The mutex name serves as a unique infection marker usable as a detection signature or kill-switch

Answer

Mutexes encrypt the malware's configuration block

Answer

The mutex name encodes the C2 server IP address

Answer

Creating a mutex prevents the Windows Defender service from scanning the process

Question 7

When analyzing a packed executable, the original entry point (OEP) is commonly found by looking for what pattern at the end of the unpacking stub?

Accepted Answer

A jump or call to a calculated address in the newly written memory region, followed by execution transferring to the original code

Answer

A call to ExitProcess immediately after decryption completes

Answer

An INT 3 breakpoint instruction signaling the debugger to stop

Answer

The string 'OEP=' embedded in the stub's data section