Malware Flow Control and Structures GREM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You are analyzing a malware binary that appears to have a single large function with a central dispatcher that reads a state variable and jumps to different code blocks. Each block updates the state variable and jumps back to the dispatcher. Which obfuscation technique is being used?

   • AJump table obfuscation
   • BControl flow flattening
   • COpaque predicates
   • DSEH-based obfuscation
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which flag is primarily used by the JBE (jump if below or equal) instruction for unsigned comparisons?

   • AAF (auxiliary flag)
   • BPF (parity flag)
   • CSF (sign flag) and OF (overflow flag)
   • DCF (carry flag) and ZF
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   While analyzing a heavily obfuscated malware binary, you notice that the code consists of a large dispatch loop that reads a state variable from a global memory location and uses it to index into a jump table. Each basic block ends by updating the state variable and jumping back to the dispatch loop. This pattern is repeated throughout the binary. What is the most likely obfuscation technique, and what is the best strategy to analyze it?

   • ASEH-based obfuscation; use a debugger to catch exceptions and trace the handler.
   • BJump table obfuscation; use a debugger to trace each jump manually.
   • CControl flow flattening; use symbolic execution or a decompiler that supports state-machine recovery.
   • DOpaque predicates; manually patch each branch to force the true path.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In assembly, which loop structure is characterized by the condition being checked at the bottom of the loop, guaranteeing at least one iteration?

   • Awhile loop
   • Binfinite loop
   • Cdo-while loop
   • Dfor loop
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why might malware authors use Structured Exception Handling (SEH) as an anti-debugging technique?

   • ATo bypass the need for a valid digital signature
   • BTo intentionally trigger exceptions and redirect execution to a handler that performs malicious actions
   • CTo encrypt the malware's code using the exception handler as a key
   • DTo increase the size of the malware binary to evade antivirus
   Reveal Solution Discussion Select an answer first