Malware Flow Control and Structures GREM Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common example of an opaque predicate?

   • Aif (user_input == 0) { ... }
   • Bif (x * x >= 0) { ... } where x is an integer
   • Cif (a == b) { ... } where a and b are function parameters
   • Dif (random() > 0.5) { ... }
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which instruction sequence is commonly found in a function prologue to set up a new stack frame?

   • APUSH EBP; MOV EBP, ESP
   • BXOR EAX, EAX; RET
   • CADD ESP, 4; RET
   • DMOV ESP, EBP; POP EBP
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is an opaque predicate in the context of malware obfuscation?

   • AA condition that always evaluates to the same value but is difficult for an analyst to determine statically
   • BA conditional jump that depends on user input
   • CA function that never returns
   • DA jump table used to obfuscate switch-case logic
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   After a CMP instruction, which conditional jump instruction would be taken if the zero flag (ZF) is set?

   • AJL (jump if less)
   • BJG (jump if greater)
   • CJNE (jump if not equal)
   • DJE (jump if equal)
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A malware sample contains the following code: `xor eax, eax; test eax, eax; jz real_path; jmp fake_path`. Static analysis shows both paths lead to different code, but dynamic analysis always takes `real_path`. What is the most likely purpose of the `fake_path`?

   • AIt is a legitimate alternate code path for error handling
   • BIt is a decoy to trigger anti-debugging
   • CIt is an opaque predicate designed to confuse static analysis
   • DIt is a jump table entry for a switch-case
   Reveal Solution Discussion Select an answer first