Malware Flow Control and Structures GREM Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A malware sample uses SEH to hide its main logic. The initial code sets up an exception handler that, when an invalid memory access occurs, transfers control to a decryption routine. You are debugging the sample and want to trace the SEH chain to find the handler. Which approach is most effective?

   • ADisassemble the binary and look for the `push` instructions that set up the SEH frame.
   • BUse a debugger command to display the SEH chain (e.g., `!exchain` in WinDbg) and set a breakpoint on the handler address.
   • CPatch the exception handler to a known function and observe the behavior.
   • DRun the sample in a sandbox and monitor for exceptions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When analyzing a switch-case construct in disassembly, which instruction is typically used to transfer control to the selected case?

   • AJMP [table + index*4]
   • BRET [table + index*4]
   • CCALL [table + index*4]
   • DMOV EAX, [table + index*4]
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   In a malware sample, you see the instruction `call [ebx+8]` where EBX points to a structure that is initialized at runtime. What is the most accurate way to describe this call?

   • AAn indirect call through a function pointer stored in a structure
   • BA call to a system API via the import table
   • CA direct call to a fixed address
   • DA call to a jump table entry
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why do malware authors use indirect calls through registers or memory?

   • ATo make it harder for static analysis to determine the target of the call
   • BTo improve the performance of the malware
   • CTo make the malware compatible with all versions of Windows
   • DTo reduce the size of the malware binary
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   While analyzing a malware binary, you notice that the code is structured as a large loop that reads a state variable from a global location, uses it to index into a jump table, and then executes a basic block that ends by updating the state variable and jumping back to the loop. This pattern repeats throughout the binary. What is the most effective way to reconstruct the original control flow?

   • AUse a decompiler that supports control flow flattening recovery, such as Hex-Rays with the HexRaysCodeXplorer plugin.
   • BPatch the state variable to a fixed value and observe which block executes.
   • CUse a debugger to set breakpoints on every instruction and record the execution trace.
   • DManually trace each jump in a debugger and build a graph by hand.
   Reveal Solution Discussion Select an answer first