Malware Analysis Concepts and Basic Analysis Techniques GCED Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An analyst executes a malware sample in a controlled lab and uses a tool to record which files are created, modified, or deleted. Which type of analysis is being performed?

   • AStatic analysis
   • BDynamic analysis
   • CSignature analysis
   • DString analysis
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of using a sandbox when analyzing malware?

   • ATo safely execute malware in an isolated environment and observe its behavior
   • BTo identify the malware's author
   • CTo speed up the analysis process
   • DTo decompile the malware into readable source code
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A malware analyst is examining a suspicious executable and finds that the file's PE header indicates a section with high entropy and an import table that only contains `LoadLibrary` and `GetProcAddress`. The analyst suspects the file is packed. Which conclusion is most justified?

   • AThe file is definitely malicious because it uses dynamic imports.
   • BThe file is a DLL because it uses LoadLibrary.
   • CThe file is likely packed, and static analysis of the original code will require unpacking.
   • DThe file is not packed because it has an import table.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst must analyze a malware sample that requires internet access to download a second-stage payload. The analyst has a sandbox with a virtual network that can be configured with full internet access, a fake DNS server, or no network. The analyst needs to observe the download behavior while minimizing risk to the production network. Which configuration best balances these needs?

   • ADisable the network adapter entirely and observe the malware's behavior without network.
   • BUse a fake DNS server that resolves all domains to a local sinkhole, and run a local HTTP server to serve a benign payload.
   • CProvide full internet access and monitor the traffic with a network sniffer.
   • DUse a VPN to route traffic through a secure tunnel to the internet.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A malware sample creates a service named 'WindowsUpdateSvc' and modifies the registry key `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` to point to a malicious binary. Which set of observations best describes the malware's persistence mechanism?

   • AIt uses a DLL search-order hijack and an AppInit_DLLs entry.
   • BIt uses a WMI event subscription and a boot execute entry.
   • CIt uses a scheduled task and a startup folder entry.
   • DIt uses a service and a registry Run key to achieve persistence.
   Reveal Solution Discussion Select an answer first