Interactive and Manual Malware Analyses GCED Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which observation is characteristic of dynamic analysis?

   • AThe malware creates a new registry key during execution
   • BThe malware's PE header indicates it was compiled with MinGW
   • CThe malware's import table includes CreateProcess
   • DThe malware contains the string 'C:\Windows\System32\cmd.exe'
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After completing an interactive dynamic analysis of a ransomware sample in an isolated VM, an analyst has logs showing the malware created a file named `C:\Users\Public\encrypt.exe`, added a registry run key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, and attempted connections to `192.0.2.10:4444`. Which set of items should the analyst extract as IOCs for the final report?

   • AThe file path, the registry key path, and the IP address and port.
   • BThe malware's process ID and the VM's IP address, because they are unique to the analysis session.
   • CThe VM's hostname and the analyst's username, because they are needed for the report's metadata.
   • DOnly the SHA-256 hash of the original sample, because it is the most reliable IOC.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is debugging a malware sample that uses a custom packing algorithm. The analyst has identified the OEP and dumped the unpacked binary. However, the dumped binary crashes when run outside the debugger. What is the most likely cause, and what should the analyst do?

   • AThe malware is using a VM detection technique and crashes because it is not in a VM.
   • BThe dump was taken at the wrong time or the import table was not reconstructed; the analyst should use an import reconstruction tool like Scylla to fix the dump.
   • CThe malware is checking for the presence of a debugger and crashes when it does not find one.
   • DThe dump is too large and needs to be compressed before running.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the main purpose of dynamic analysis in an interactive malware analysis session?

   • ATo identify the compiler used to build the malware
   • BTo extract strings from the binary for IOC identification
   • CTo observe the malware's runtime behavior in a controlled environment
   • DTo examine the malware's code without executing it
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the first step when analyzing a packed malware sample?

   • ADelete the sample because it is too dangerous
   • BRun the sample in a sandbox and rely on behavioral logs
   • CUnpack the sample to reveal the original code
   • DSubmit the sample to an antivirus vendor
   Reveal Solution Discussion Select an answer first