GREM Malicious Executable Analysis 2

Question 1

When examining a PE file's Import Address Table (IAT), which API combination most strongly suggests process injection capability?

Accepted Answer

OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread

Answer

OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread is the classic four-API sequence for remote process injection.

Question 2

A malware sample's section header shows a section named '.text' with both IMAGE_SCN_MEM_EXECUTE and IMAGE_SCN_MEM_WRITE flags set. Why is this suspicious?

Accepted Answer

Executable sections are normally read-only, not writable, indicating possible self-modifying or packed code

Answer

Legitimate code sections are typically read+execute only; write permission on an executable section suggests self-modifying code or a packer that modifies code at runtime.

Question 3

During dynamic analysis, a malware sample calls SetWindowsHookEx with idHook set to WH_KEYBOARD_LL. What is the most likely purpose?

Accepted Answer

Keylogging to capture user keystrokes system-wide

Answer

WH_KEYBOARD_LL installs a low-level keyboard hook that intercepts all keystrokes system-wide, making it the standard keylogging technique.

Question 4

A malicious DLL exports a function named 'DllRegisterServer'. What evasion or persistence technique does this support?

Accepted Answer

Masquerading as a COM server DLL to enable regsvr32-based execution and persistence

Answer

DllRegisterServer is the required export for COM registration, allowing attackers to use regsvr32.exe as a living-off-the-land launcher and persistence mechanism.

Question 5

In IDA Pro, you notice a function that XORs a buffer with a single-byte key and then calls a Windows API. What is the best first step to reveal the buffer's contents?

Accepted Answer

Identify the key byte and write a script to XOR-decode the buffer statically

Answer

Extracting the single-byte XOR key and decoding the buffer statically (e.g., with an IDAPython script) immediately reveals the hidden data without needing to run the malware.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Malicious Executable Analysis 2