Malware Analysis Fundamentals GREM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In security operations, which activity is considered part of the scope of malware analysis?

   • AInterviewing employees to determine how the malware was introduced
   • BConfiguring firewall rules to block all outbound traffic from the infected host
   • CRestoring the infected system from a known-good backup
   • DDetermining the malware's persistence mechanism and network communication behavior
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is analyzing a piece of ransomware that encrypts files and displays a ransom note. The analyst needs to determine the encryption algorithm and whether the decryption key is stored locally. Which combination of techniques is most effective?

   • AOnly perform static analysis of the binary's imports
   • BOnly review the ransom note for the encryption algorithm
   • CSearch the internet for the ransom note text
   • DRun the ransomware in a sandbox and monitor file system activity, then use a debugger to trace the encryption function
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A malware analyst is working on a sample that is packed with a custom packer. The analyst needs to unpack the binary to analyze its true code. Which approach is most appropriate?

   • AUse dynamic analysis to let the malware unpack itself in a controlled environment, then dump the process memory.
   • BSkip unpacking and analyze the packed binary directly with a disassembler.
   • CSubmit the packed binary to an antivirus engine for generic unpacking.
   • DUse a static unpacker tool that claims to handle all packers.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An incident response team is analyzing a malware sample that is known to use a domain generation algorithm (DGA) to communicate with its C2 server. The team needs to identify the C2 domain for the current day to block it. Which approach is most effective?

   • ASearch the internet for known DGA domains associated with the malware family.
   • BUse static analysis to extract the DGA algorithm and manually compute the domain for the current date.
   • CRun the malware in a sandbox with simulated network responses and capture the domains it attempts to resolve.
   • DBlock all domains that the malware's hash is associated with in threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is analyzing a piece of malware that uses a custom packer. The team has tried generic unpacking tools but they fail. The team needs to unpack the malware to analyze its code. Which approach is most likely to succeed?

   • AUse a different generic unpacking tool
   • BManually trace the unpacking stub in a debugger and dump the unpacked code at the original entry point (OEP)
   • CRun the malware in a sandbox and capture its network traffic
   • DPerform static analysis on the packed binary
   Reveal Solution Discussion Select an answer first