A malware analyst is reverse engineering a new Android banking trojan. The APK is packed with a commercial packer, and the analyst has unpacked it in a rooted emulator. The unpacked DEX file contains a class that uses reflection to invoke methods from the Android framework. Static analysis shows the class has a method that takes a string and uses it to call Class.forName() and getMethod(). The analyst also notices that the app checks for the presence of Frida and Xposed frameworks. Which approach is most effective for understanding the malware's behavior given these constraints?

Run the app in a standard Android emulator without root and rely on logcat output to see the reflected method calls.

Use a custom Frida script that hooks the reflection calls to log the class names and method names being invoked, while also bypassing the anti-Frida checks by hooking the detection functions.

Submit the APK to a public sandbox like VirusTotal and wait for the automated report to reveal the reflected methods.

Decompile the unpacked DEX with jadx and manually trace all reflection calls by reading the string constants and method invocations.

During malware behavior analysis, an analyst observes that a malicious app registers a broadcast receiver to restart itself after the device reboots. Which behavior is the malware exhibiting?

Command and control communication

A malware analyst is reverse engineering a suspicious Android app that uses native code (JNI) to hide its malicious behavior. The analyst has decompiled the DEX code and found that the app loads a native library named 'libhidden.so'. The analyst needs to analyze the native library to understand its functionality. Which approach is MOST effective for analyzing the native library?

Use a disassembler like Ghidra or IDA Pro to analyze the ARM assembly code of the native library.

Search the native library for strings to understand its functionality.

Run the app in a sandbox and capture the native library's behavior.

Use jadx to decompile the native library into Java code.

GIAC Advanced Smartphone Forensics

Domain 4Objective 1

Mobile Device Malware Analysis GASF Practice Questions (Page 3)

Part of the Mobile Device Malware Analysis domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 8–12 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

11concepts

Questions 11–15

11expert · hard
A malware analyst is reverse engineering a new Android banking trojan. The APK is packed with a commercial packer, and the analyst has unpacked it in a rooted emulator. The unpacked DEX file contains a class that uses reflection to invoke methods from the Android framework. Static analysis shows the class has a method that takes a string and uses it to call Class.forName() and getMethod(). The analyst also notices that the app checks for the presence of Frida and Xposed frameworks. Which approach is most effective for understanding the malware's behavior given these constraints?
Select an answer first
12foundation · easy
Which mobile malware infection vector occurs when a user visits a compromised website and malware is silently downloaded without any user interaction?
Select an answer first
13foundation · easy
During malware behavior analysis, an analyst observes that a malicious app registers a broadcast receiver to restart itself after the device reboots. Which behavior is the malware exhibiting?
Select an answer first
14expert · hard
A malware analyst is reverse engineering a suspicious Android app that uses native code (JNI) to hide its malicious behavior. The analyst has decompiled the DEX code and found that the app loads a native library named 'libhidden.so'. The analyst needs to analyze the native library to understand its functionality. Which approach is MOST effective for analyzing the native library?
Select an answer first
15foundation · easy
Which reverse engineering activity involves stepping through the malware's code line by line to observe its execution flow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Mobile Device Malware Analysis GASF Practice Questions (Page 3)

Questions 11–15

Which mobile malware infection vector occurs when a user visits a compromised website and malware is silently downloaded without any user interaction?

During malware behavior analysis, an analyst observes that a malicious app registers a broadcast receiver to restart itself after the device reboots. Which behavior is the malware exhibiting?

Which reverse engineering activity involves stepping through the malware's code line by line to observe its execution flow?

Keep studying — Mobile Device Malware Analysis