Static Malware Analysis DFE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is analyzing a malware sample that uses dynamic API resolution. The import table only contains LoadLibrary and GetProcAddress. The analyst needs to identify the specific APIs the malware calls. Which approach is most effective?

   • ASearch the binary for strings that match API names.
   • BExamine the export table of the binary.
   • CUse dynamic analysis to capture the resolved API calls at runtime.
   • DUse a PE viewer to see the full import table.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What does it indicate if a tool like PEiD or Detect It Easy reports that an executable is 'packed'?

   • AThe executable is digitally signed
   • BThe executable is a 64-bit application
   • CThe executable's code is compressed or encrypted and will be unpacked at runtime
   • DThe executable is a Windows system file
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A malware analyst extracts the resources from a suspicious executable and finds a large binary blob in the 'RCData' section, along with a custom icon. The strings inside the blob include 'MZ' and 'This program cannot be run in DOS mode'. What is the most likely conclusion?

   • AThe blob is a compressed archive that contains the malware's configuration.
   • BThe blob is an embedded executable that the malware may drop or execute.
   • CThe blob is a legitimate DLL that the malware uses for functionality.
   • DThe blob is a decoy and has no relevance to the malware's behavior.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During static analysis of a Windows executable, an analyst examines the PE header and notices that the SizeOfOptionalHeader field is larger than the standard value for a PE32+ file. What should the analyst infer?

   • AThe file is corrupted and cannot be analyzed.
   • BThe file may have additional data in the optional header, possibly indicating a custom or modified header.
   • CThe file is definitely packed with a known packer.
   • DThe file is definitely a 64-bit executable.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A malware analyst has a sample that is detected by only one antivirus engine as 'Trojan.Generic'. The analyst needs to determine if the file is truly malicious. Which approach is most appropriate?

   • ASubmit the file to a different online scanner and rely on its result.
   • BConclude the file is benign because only one engine detects it.
   • CConclude the file is malicious because at least one engine detects it.
   • DPerform additional static analysis, such as examining imports and strings, and consider dynamic analysis if needed.
   Reveal Solution Discussion Select an answer first