GREM Malware Deobfuscation Techniques 2

Question 1

A malware sample uses a custom XOR key that changes based on the byte position (key = position % 7). What type of obfuscation is this?

Accepted Answer

Rolling XOR encoding

Answer

Rolling XOR uses a key that varies with position rather than a fixed static value, making simple frequency analysis harder.

Question 2

During dynamic analysis, a malware unpacks itself into a newly allocated memory region and then executes from that region. Which technique best describes this?

Accepted Answer

In-memory unpacking

Answer

In-memory unpacking decrypts or decompresses the real payload into allocated memory and transfers execution there without writing to disk.

Question 3

An analyst sees the instruction sequence 'PUSH reg; POP reg' repeated many times with no net effect. What obfuscation category does this represent?

Accepted Answer

Junk instruction insertion

Answer

Junk instructions (also called dead code) are inserted to increase analysis effort without changing the program's logical behavior.

Question 4

A script-based malware uses concatenation and character code lookups to build function names at runtime. Which deobfuscation approach is most efficient?

Accepted Answer

Set breakpoints after string construction and inspect values

Answer

Breakpointing after the string is fully assembled in memory lets you read the resolved name without tracing every concatenation step.

Question 5

What does the term 'VM-based obfuscation' mean in the context of malware protection?

Accepted Answer

The malware bytecode runs on a custom interpreter embedded in the sample

Answer

VM-based obfuscation converts native code to custom bytecode that a bundled interpreter executes, preventing standard disassemblers from analyzing the logic.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Malware Deobfuscation Techniques 2