GREM Malware Analysis Fundamentals 2

Question 1

Which tool is most commonly used for static analysis of PE (Portable Executable) file headers without executing the sample?

Accepted Answer

PEview

Answer

PEview parses and displays the PE file structure, headers, and sections without executing the binary.

Question 2

In malware analysis, what does the term 'packers' refer to?

Accepted Answer

Programs that obfuscate and compress malware to evade detection

Answer

Packers compress and/or encrypt the malware payload and wrap it in a stub that decompresses it at runtime.

Question 3

When performing dynamic analysis, why is it important to use a network simulation tool like INetSim or FakeNet-NG?

Accepted Answer

To simulate network services so malware behaves as if connected to the internet

Answer

INetSim and FakeNet-NG simulate DNS, HTTP, and other services so malware that checks connectivity or downloads payloads can be observed safely.

Question 4

What does the Import Address Table (IAT) reveal during static malware analysis?

Accepted Answer

The API functions the malware uses from external DLLs

Answer

The IAT lists the external DLL functions a binary imports, giving analysts insight into the malware's potential capabilities.

Question 5

Which of the following best describes 'code injection' in the context of malware analysis?

Accepted Answer

Writing malicious code into another running process's memory space

Answer

Code injection involves writing and executing malicious code within a legitimate process to evade detection and gain its privileges.

(GREM) Giac Reverse Engineering Malware Practice Test