GREM Malware Deobfuscation Techniques 2

Question 1

A malware sample uses a custom XOR key that changes based on the byte position (key = position % 7). What type of obfuscation is this?

Accepted Answer

Rolling XOR encoding

Answer

Static XOR encoding

Answer

RC4 stream cipher

Answer

AES block cipher

Question 2

During dynamic analysis, a malware unpacks itself into a newly allocated memory region and then executes from that region. Which technique best describes this?

Accepted Answer

In-memory unpacking

Answer

Code injection

Answer

DLL hijacking

Answer

Process hollowing

Question 3

An analyst sees the instruction sequence 'PUSH reg; POP reg' repeated many times with no net effect. What obfuscation category does this represent?

Accepted Answer

Junk instruction insertion

Answer

Opaque predicates

Answer

Control flow flattening

Answer

String encryption

Question 4

A script-based malware uses concatenation and character code lookups to build function names at runtime. Which deobfuscation approach is most efficient?

Accepted Answer

Set breakpoints after string construction and inspect values

Answer

Rewrite the script manually

Answer

Disassemble with a hex editor

Answer

Use antivirus signatures

Question 5

What does the term 'VM-based obfuscation' mean in the context of malware protection?

Accepted Answer

The malware bytecode runs on a custom interpreter embedded in the sample

Answer

The malware only runs inside virtual machines

Answer

The malware targets VMware hypervisors

Answer

The malware encrypts the host's virtual memory

Question 6

An analyst extracts a PowerShell payload from a macro that uses multiple layers of base64 encoding. What is the correct deobfuscation order?

Accepted Answer

Decode outermost layer first, working inward

Answer

Decrypt innermost layer first

Answer

All layers can be decoded simultaneously

Answer

Base64 layers do not have an order

Question 7

A PE file's import table shows only LoadLibrary and GetProcAddress. What obfuscation technique does this strongly suggest?

Accepted Answer

Dynamic API resolution

Answer

Section packing

Answer

Thread injection

Answer

Heap spray