Examining .NET Malware GREM Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A malware analyst is examining a binary that has both managed and unmanaged code. The managed code is written in C# and uses the .NET Framework, while the unmanaged code is a native DLL that is loaded via P/Invoke. Which statement accurately describes the relationship between these two types of code?

   • AThe unmanaged code is executed by the CLR, while the managed code is executed by the operating system.
   • BThe managed code is compiled to native code at compile time, while the unmanaged code is interpreted.
   • CBoth types of code are executed by the CLR, but they use different memory management systems.
   • DThe managed code runs under the control of the CLR, while the unmanaged code runs directly on the operating system.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is a critical safety measure when setting up a dynamic analysis environment for .NET malware?

   • AUse an isolated virtual machine with no network access or with simulated network services.
   • BDisable the firewall to allow the malware to communicate freely.
   • CUse a shared folder with the host to easily transfer files.
   • DRun the malware on the host machine for better performance.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which tool is commonly used to unpack a packed .NET executable by dumping the managed assembly from memory?

   • AdnSpy
   • BWireshark
   • CProcess Explorer
   • DOllyDbg
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst receives a file that is detected as .NET malware, but opening it in dnSpy shows only a small stub with a call to an unmanaged function. The file has a large overlay section. What is the most likely situation, and what should the analyst do next?

   • AThe file is obfuscated with control-flow flattening; the analyst should apply a deobfuscator plugin.
   • BThe file is packed; the analyst should use a .NET unpacker or run it in a sandbox to dump the managed payload from memory.
   • CThe file is a .NET loader that will download the real payload; the analyst should focus on network indicators.
   • DThe file is a native executable that was misclassified; the analyst should analyze it with native tools like IDA Pro.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An analyst is analyzing a .NET malware sample that uses a custom string encryption routine. The analyst has identified the decryption method and wants to recover all plaintext strings statically. What is the most efficient approach?

   • ARun the malware in a sandbox and use a memory dump tool to extract the decrypted strings from the process heap.
   • BUse a .NET decompiler to view the decrypted strings in the decompiled source.
   • CWrite a small C# script that loads the assembly, invokes the decryption method for each encrypted string, and prints the results.
   • DUse a hex editor to search for the encrypted byte arrays and manually decode them using the identified algorithm.
   Reveal Solution Discussion Select an answer first