GREM Malware Analysis Fundamentals 2

Question 1

Which tool is most commonly used for static analysis of PE (Portable Executable) file headers without executing the sample?

Accepted Answer

PEview

Answer

Wireshark

Answer

OllyDbg

Answer

Volatility

Question 2

In malware analysis, what does the term 'packers' refer to?

Accepted Answer

Programs that obfuscate and compress malware to evade detection

Answer

Tools that compress network packets

Answer

Utilities that package malware into ZIP archives

Answer

Antivirus evasion scripts written in Python

Question 3

When performing dynamic analysis, why is it important to use a network simulation tool like INetSim or FakeNet-NG?

Accepted Answer

To simulate network services so malware behaves as if connected to the internet

Answer

To speed up malware execution

Answer

To allow malware to infect real systems for observation

Answer

To capture disk writes by the malware

Question 4

What does the Import Address Table (IAT) reveal during static malware analysis?

Accepted Answer

The API functions the malware uses from external DLLs

Answer

The list of files the malware will delete

Answer

The encryption keys used by the malware

Answer

The list of registry keys the malware reads

Question 5

Which of the following best describes 'code injection' in the context of malware analysis?

Accepted Answer

Writing malicious code into another running process's memory space

Answer

Inserting malicious SQL into a database query

Answer

Modifying the kernel's memory allocation table

Answer

Adding shellcode to a PDF document

Question 6

What is the purpose of examining the '.rsrc' section of a PE file during malware analysis?

Accepted Answer

To locate embedded resources such as icons, strings, or secondary payloads

Answer

To find encrypted communications channels

Answer

To identify the malware's network signatures

Answer

To determine the compiler version used

Question 7

During sandbox analysis of a malware sample, you notice it sleeps for 300 seconds before executing its payload. What technique does this likely represent?

Accepted Answer

Sandbox evasion via time delays

Answer

Rootkit installation

Answer

Polymorphic code mutation

Answer

Anti-debugging via INT3 breakpoints