Malware Forensics ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A malware analyst is examining a binary that appears to have a low entropy section and a small number of imported functions. The binary also contains a section named '.UPX0' and '.UPX1'. The analyst suspects the binary is packed. Which static analysis technique would best confirm this and help unpack the binary?

   • ASearch the binary for the string 'UPX' using a hex editor
   • BRun the binary in a sandbox and observe its behavior
   • CUse a debugger to step through the unpacking stub at runtime
   • DUse a tool like PEiD or Detect It Easy to identify the packer and then use the corresponding unpacking tool
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   After completing dynamic analysis of a trojan, an analyst must write a forensic report for legal proceedings. Which element is most important to include to ensure the report is defensible in court?

   • AThe malware's source code, if available
   • BA detailed chain of custody and hash values of the analyzed sample
   • CA list of all antivirus products that detect the sample
   • DThe analyst's personal opinion about the malware's origin
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A malware analyst is reverse engineering a trojan that uses a custom obfuscation technique to hide its control flow. The analyst has identified that the trojan uses a state machine to decide which payload to execute based on the system's locale. The analyst needs to understand the logic and determine which payload is executed for a specific locale. Which approach is most effective?

   • AUse a disassembler to statically trace all possible paths through the state machine
   • BUse a debugger to set a breakpoint on the locale-checking function and modify the return value to force a specific path
   • CUse a packet sniffer to capture network traffic and infer the payload from the C2 communication
   • DUse a hex editor to search for the locale strings and manually map them to payloads
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a typical observation made during dynamic malware analysis?

   • AChanges to the Windows registry
   • BThe file's cryptographic hash
   • CThe malware's import table
   • DThe malware's packed sections
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A malware analyst is reverse engineering a trojan that uses anti-debugging techniques. The analyst needs to understand the control flow of the main function and bypass the anti-debugging checks to reach the payload. Which tool and technique combination is most appropriate?

   • AUse a debugger like x64dbg to set breakpoints on the anti-debugging functions and modify the flags or registers at runtime
   • BUse a hex editor to change the anti-debugging API calls to NOP instructions and then run the binary
   • CUse a disassembler like IDA Pro to view the assembly code and manually patch the anti-debugging checks in the binary
   • DUse a packet sniffer to capture network traffic and infer the payload from the C2 communication
   Reveal Solution Discussion Select an answer first