Static Analysis Fundamentals GREM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which PE resource is commonly used to display an icon for an executable and can be extracted for analysis?

   • AManifest
   • BIcon
   • CString Table
   • DVersion Info
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is examining a malware sample and finds a version info resource that claims the product is 'Microsoft Windows' with a company name of 'Microsoft Corporation'. However, the file's digital signature is invalid, and the manifest requests 'requireAdministrator' execution level. The analyst also finds a custom resource containing an encrypted blob. What is the most reasonable conclusion?

   • AThe file is a third-party application that was incorrectly attributed to Microsoft by the version info.
   • BThe file is a legitimate Microsoft binary that has been corrupted.
   • CThe file is likely malware that is spoofing Microsoft to appear legitimate and requesting admin privileges.
   • DThe file is a Microsoft driver that requires administrator privileges to install.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool is specifically designed to detect packers and compilers by scanning PE files against a signature database?

   • AProcmon
   • BWireshark
   • CGhidra
   • DPEiD
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst needs to check if a newly discovered malware sample matches any previously analyzed binaries in the organization's malware repository. The repository stores samples by their MD5 hash. The analyst computes the MD5 of the new sample and finds no match. What is the most appropriate next step to improve the chance of finding a match?

   • AUse a fuzzy hashing tool like ssdeep to compare the sample against repository files.
   • BCompare the sample's import table and section names against the repository's metadata.
   • CSearch the repository for files with the same file size and compilation timestamp.
   • DCompute SHA-256 and search the repository for that hash as well.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst receives a suspicious Windows executable and runs `file` and `strings` on it. The `file` output identifies it as a PE32 executable, but `strings` reveals only a handful of readable ASCII strings, none of which are meaningful API names. The PE has three sections named `.text`, `.rdata`, and `.UPX0`. What should the analyst conclude from these static indicators?

   • AThe binary is a DLL because the `.rdata` section contains read-only data, and the entry point should be inspected next.
   • BThe binary is a .NET assembly because of the `.rdata` section, and strings should be extracted using a managed-code parser.
   • CThe binary is likely packed with UPX, and dynamic analysis or unpacking is needed before meaningful string analysis.
   • DThe binary is clean because the section names are standard and the file command confirms a valid PE32 format.
   Reveal Solution Discussion Select an answer first