Static Analysis Fundamentals GREM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst receives a file with no extension and runs `file` on it. The output is `PE32 executable (GUI) Intel 80386, for MS Windows`. The analyst also computes a SHA-256 hash. What is the most appropriate next step?

   • AParse the PE header to determine if the file is an EXE or DLL and inspect the entry point.
   • BUse `strings` to extract all strings and look for URLs, since the file type is already confirmed.
   • CRename the file to `.exe` and execute it to confirm it runs.
   • DSubmit the hash to VirusTotal immediately, since the file type is already known.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which tool provides a graphical interface for viewing and editing PE headers, sections, and resources?

   • Astrings
   • BCFF Explorer
   • Chashdeep
   • Dfile
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is performing static analysis on a malware sample and finds the following: the import table contains IsDebuggerPresent and CheckRemoteDebuggerPresent, the .rdata section contains the strings 'C:\Program Files\VMware' and 'C:\Program Files\VirtualBox', and the file has a section named .tls with unusual characteristics. What is the most likely purpose of these indicators?

   • AThe malware is packed, and these strings are part of the unpacking stub.
   • BThe malware is a virtual machine monitor that needs to detect its environment.
   • CThe malware is a debugging tool that checks for virtual machines to ensure compatibility.
   • DThe malware is using anti-analysis techniques to detect debuggers and virtual machines and evade them.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is using pestudio to review a suspicious executable. The tool's entropy calculation shows the .text section has an entropy of 7.8, and the section's name is .text but it has both write and execute permissions. The import table shows only LoadLibraryA and GetProcAddress. What is the most likely conclusion?

   • AThe file is a legitimate program that uses runtime dynamic linking for plugins.
   • BThe file is packed, and the .text section contains the unpacking stub that will load the real APIs dynamically.
   • CThe file is a DLL that exports functions to be called by other programs.
   • DThe file is a .NET assembly that uses reflection to call APIs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A malware analyst is reviewing a PE file and notes that the `.text` section has both `MEM_EXECUTE` and `MEM_WRITE` flags set, and the entropy of the section is 7.9. What should the analyst infer from these characteristics?

   • AThe section is likely packed or obfuscated, and the writable-and-executable flags may indicate self-modifying code.
   • BThe section is a data section that stores encrypted strings for later decryption.
   • CThe section is a standard code section, and the high entropy is due to normal compiler optimizations.
   • DThe section is a resource section that contains embedded configuration data.
   Reveal Solution Discussion Select an answer first