Interactive and Manual Malware Analyses GCED Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of interactive malware analysis compared to automated analysis?

   • ATo execute malware in a sandbox and automatically generate a report
   • BTo allow an analyst to make decisions and guide the analysis process in real time
   • CTo run malware on a production system to observe real-world impact
   • DTo replace the need for human expertise by using machine learning classifiers
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   While performing static analysis on a Windows PE file, an analyst notices that the import table contains only `LoadLibraryA` and `GetProcAddress`. The rest of the API calls are resolved at runtime. What is the most likely reason for this observation?

   • AThe malware is written in a high-level language that does not use the Windows API.
   • BThe malware is using dynamic API resolution to evade static import analysis and hide its functionality.
   • CThe file is a DLL, so it does not have an import table.
   • DThe file is packed, so the import table is compressed and only a few functions are visible.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is setting up a malware analysis lab. The lab will be used to analyze network worms that propagate over SMB. Which network configuration is the safest for preventing the worm from escaping the lab?

   • AUse a bridged network and monitor for SMB traffic with a network sniffer.
   • BPlace all analysis VMs on an isolated virtual network with no route to the corporate network or the internet.
   • CUse a NAT network so the VMs can reach the internet, and rely on the malware not having a SMB exploit.
   • DConnect the analysis VMs to the corporate network but block SMB traffic at the host firewall.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is performing static analysis on a suspicious document that contains an embedded macro. The analyst extracts the macro and sees a long string of hexadecimal characters that is decoded at runtime. What is the most likely purpose of this obfuscation, and what should the analyst do to understand the macro's functionality?

   • AThe obfuscation is a checksum; the analyst should compare it with known malware hashes.
   • BThe obfuscation hides the malicious payload from static scanners; the analyst should decode the hex string manually or with a script to reveal the actual commands.
   • CThe obfuscation is used to compress the macro to reduce file size; the analyst should decompress it with a standard archive tool.
   • DThe obfuscation is a digital signature; the analyst should verify it with the document's certificate.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team has a malware sample that only exhibits malicious behavior when it receives a specific command from a C2 server. An automated sandbox report shows no suspicious activity. An analyst decides to perform interactive malware analysis. What is the primary advantage of interactive analysis in this scenario?

   • AInteractive analysis is faster than automated analysis because it uses pre-configured scripts.
   • BThe analyst can interact with the malware, simulate the C2 response, and observe the triggered behavior.
   • CInteractive analysis guarantees the malware will be fully unpacked and deobfuscated.
   • DInteractive analysis eliminates the need for a controlled environment because the analyst can stop execution at any time.
   Reveal Solution Discussion Select an answer first