Mobile Device Malware Analysis GASF Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A malware analyst is reverse engineering a heavily obfuscated Android APK. The analyst has successfully decompiled the DEX code to Java using jadx, but the code is filled with meaningless identifier names (e.g., 'a.a.a.a') and string encryption. The analyst needs to understand the app's behavior, particularly its network communications. Which approach is most efficient for understanding the obfuscated code?

   • AFocus only on the AndroidManifest.xml to understand the app's permissions and declared components, and infer behavior from that.
   • BUse a DEX decompiler that automatically deobfuscates code, such as a tool that can reverse string encryption and rename identifiers.
   • CManually rename every obfuscated identifier in jadx to meaningful names based on the strings they reference.
   • DUse a dynamic analysis sandbox to execute the app and capture its network traffic, then correlate the observed traffic with the decompiled code.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analyst is performing dynamic analysis of a suspicious Android app in a sandbox. The app is observed to read the device's contact list and then send an HTTP POST request to a remote server. The analyst wants to determine if the app is exfiltrating the contact data. Which observation would provide the STRONGEST evidence of data exfiltration?

   • AThe HTTP POST request body contains the contact data in plaintext, and the request is sent to a domain that is not associated with the app's stated functionality.
   • BThe app requests the READ_CONTACTS permission in its manifest.
   • CThe app sends a POST request to a server located in a foreign country.
   • DThe app uses HTTPS to communicate with the remote server.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which static analysis technique involves inspecting an Android app's AndroidManifest.xml to identify requested permissions and components?

   • ANetwork traffic capture
   • BSandbox execution
   • CManifest analysis
   • DDynamic instrumentation
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A forensic examiner is investigating an Android device that is suspected of being infected with spyware. The device is rooted, and the examiner has full filesystem access. The examiner finds a suspicious APK in /data/app/ that is not present in the user's app list. The APK's manifest requests the BIND_ACCESSIBILITY_SERVICE permission. The examiner also finds a file in /data/data/com.suspicious.app/shared_prefs/ containing encrypted strings. The device's logcat shows repeated attempts to connect to an IP address on port 443. Which forensic finding is the most significant indicator of a persistence mechanism?

   • AThe BIND_ACCESSIBILITY_SERVICE permission, which allows the app to observe and interact with the UI of other apps.
   • BThe repeated connections to an IP address on port 443, which indicate C2 communication.
   • CThe encrypted strings in shared_prefs, which suggest the app is storing sensitive data in an obfuscated manner.
   • DThe APK is present in /data/app/ but not in the user's app list, indicating the app is hidden from the launcher.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic examiner receives a Samsung Galaxy device suspected of containing a trojan that steals SMS messages. The examiner extracts the APK from the device and begins static analysis. The APK's AndroidManifest.xml shows the app requests the RECEIVE_SMS, READ_SMS, and INTERNET permissions, but the app's package name is 'com.android.systemupdater'. The APK is signed with a self-signed certificate. Which combination of static analysis findings most strongly indicates malicious behavior?

   • AThe app requests SMS permissions and INTERNET, which together enable reading and exfiltrating messages; the package name impersonates a system component, and the self-signed certificate is atypical for a legitimate system app.
   • BThe package name 'com.android.systemupdater' is a valid system package, so the app is likely a legitimate system component that was extracted by mistake.
   • CThe self-signed certificate proves the app is malicious because all legitimate apps on the Google Play Store are signed with a certificate issued by a public CA.
   • DThe app requests RECEIVE_SMS and READ_SMS permissions, which are highly dangerous and should never be granted to any third-party app.
   Reveal Solution Discussion Select an answer first