Static Analysis Fundamentals GREM Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst is examining a Windows malware sample and runs `strings` with both ASCII and Unicode options. The output includes the strings `http://malicious.example.com/update`, `CreateProcessW`, and `VirtualAllocEx`. What is the most appropriate interpretation of these findings?

   • AThe sample is a 64-bit binary because it uses `CreateProcessW` and `VirtualAllocEx`.
   • BThe sample likely performs network communication and process injection, and the strings should be correlated with the import table.
   • CThe sample is packed because the strings are readable and include API names.
   • DThe sample is a legitimate updater because it uses standard Windows APIs and a URL.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which tool is commonly used to identify a file's type by examining its magic bytes?

   • AWireshark
   • BProcmon
   • COllyDbg
   • Dfile
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is using CFF Explorer to inspect a suspicious binary. The tool shows that the binary has a section named `.themida` and a resource that contains an embedded executable. The import table is minimal. What is the most likely conclusion?

   • AThe binary is a driver because it uses Themida and has an embedded executable.
   • BThe binary is protected with Themida, a commercial packer/protector, and the embedded executable is likely a payload or a decoy.
   • CThe binary is a legitimate application that uses Themida for licensing protection.
   • DThe binary is a .NET assembly because Themida is a .NET obfuscator.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is using PEiD to scan a malware sample, but PEiD reports 'Not found' for the packer signature. The analyst then uses pestudio and sees a section named .aspack with entropy 7.9 and a suspicious import table. What is the most appropriate conclusion and next step?

   • AThe sample is likely packed with ASPack, and the analyst should use a dedicated ASPack unpacker.
   • BThe sample is a legitimate program that uses a section named .aspack for data storage.
   • CThe sample is not packed; PEiD's failure to detect a packer is definitive.
   • DThe sample is packed with an unknown packer, and the analyst should manually unpack it.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During a triage of a new malware sample, an analyst computes a SHA-256 hash and parses the PE header. The compilation timestamp in the PE header reads `0x4A5B0C00` (July 2009), and the SizeOfImage field is 0x1000. The entry point is located in the last section. What is the most reasonable next step?

   • AConclude the sample is a legitimate driver because the SizeOfImage is small and the entry point is in the last section.
   • BCheck the hash against public malware repositories to see if the sample is already known.
   • CSkip hashing and focus on the import table, since the timestamp is the only reliable indicator of the sample's origin.
   • DImmediately execute the sample in a sandbox to observe its behavior, since the timestamp is old and likely benign.
   Reveal Solution Discussion Select an answer first