Interactive and Manual Malware Analyses GCED Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the purpose of documentation and reporting in malware analysis?

   • ATo create marketing material for the security team
   • BTo provide a structured record of analysis steps, observations, and conclusions
   • CTo satisfy legal requirements only
   • DTo replace the need for further analysis
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An analyst has completed a thorough interactive analysis of a new ransomware variant and must produce a report for both technical and non-technical stakeholders. The report needs to support detection, containment, and executive decision-making. Which structure best meets these needs?

   • AA single page listing only the IOCs and the malware's SHA-256 hash.
   • BA detailed log of every API call the malware made, with no summary.
   • CExecutive summary, technical analysis details, IOCs, and recommended mitigation steps.
   • DA narrative of the analysis process, including the analyst's personal observations, with no IOCs.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst is debugging a malware sample that appears to unpack itself in memory. The analyst sets a breakpoint on the `VirtualAlloc` function and then on `VirtualProtect`. After the breakpoints are hit, the analyst wants to dump the unpacked code from memory for further static analysis. Which tool or technique is most appropriate for this task?

   • ASet a breakpoint on `WriteProcessMemory` and then use a process monitor to capture the writes.
   • BRun the sample in a sandbox and use the sandbox's 'dump files' feature to retrieve dropped files.
   • CUse a debugger's memory dump feature to save the process memory region after the unpacking routine has executed.
   • DUse a network sniffer to capture the malware's outbound traffic and infer the unpacked code from the payload.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   During interactive static analysis of a suspected trojan, an analyst opens the binary in a disassembler and notices that the import table contains only LoadLibraryA and GetProcAddress. The strings view shows a suspicious URL and a registry key path. What is the most likely reason for the sparse import table, and what should the analyst do next?

   • AThe binary is packed; the analyst should attempt to unpack it or run it in a debugger to reveal the actual imports.
   • BThe binary is legitimate; the analyst should stop analysis and report it as clean.
   • CThe binary is a driver; the analyst should check the driver entry point instead of the import table.
   • DThe binary is written in a high-level language with static linking; the analyst should focus on the strings for IOCs.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   During dynamic analysis of a banking trojan, an analyst observes that the malware injects code into a legitimate browser process and then communicates with a C2 server over HTTPS. The analyst wants to extract IOCs that would be most useful for network-based detection. Which set of IOCs is most appropriate?

   • AThe malware's mutex name and the registry key it creates.
   • BThe browser process name and the injected DLL's file path.
   • CThe C2 domain name, the JA3/JA3S TLS fingerprint, and the SHA-256 hash of the malware sample.
   • DThe IP address of the C2 server and the malware's file size.
   Reveal Solution Discussion Select an answer first