Static Analysis Fundamentals GREM Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   While analyzing a PE file, an analyst observes that the AddressOfEntryPoint field points to a location in the last section of the file, and that section has both writable and executable characteristics. The section's name is .data. What is the most reasonable conclusion from these static observations?

   • AThe file is a legitimate program that stores its main function in the .data section.
   • BThe file is likely packed, and the entry point is in the unpacking stub located in the last section.
   • CThe file is a DLL that exports its functions from the .data section.
   • DThe file is a driver that uses the .data section for kernel-mode code.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst uses pestudio to perform a quick static assessment of a suspicious binary. The tool reports a high entropy score for the `.text` section and lists several imports that are commonly used for anti-debugging. What should the analyst do next?

   • AUse a PE parser like CFF Explorer to inspect section flags and confirm whether the section is writable and executable.
   • BConclude the binary is clean because pestudio did not flag any known malware signatures.
   • CDelete the binary because it is clearly packed and cannot be analyzed further.
   • DRun the binary immediately in a sandbox to observe its behavior, since static analysis has already revealed enough.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to extract both ASCII and Unicode strings from a malware sample?

   • ABecause the 'strings' utility cannot extract Unicode strings without special flags
   • BBecause malware may use either encoding to store strings, and missing one could hide indicators
   • CBecause Unicode strings are always malicious
   • DBecause ASCII strings are used only in 32-bit binaries
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst is inspecting a suspicious executable and extracts its resources using a PE resource viewer. The version information shows `CompanyName: Microsoft Corporation` and `ProductName: Windows Update`, but the file's digital signature is invalid. What should the analyst conclude?

   • AThe file is a legitimate Microsoft binary because the version information matches a known product.
   • BThe file is a driver because it has version information and a digital signature.
   • CThe version information is likely spoofed to appear legitimate, and the invalid signature supports this conclusion.
   • DThe file is clean because the resources contain standard version information.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An analyst is asked to perform a static analysis of a suspicious binary without executing it. The binary has a section named `.aspack` and an import table that only contains `LoadLibraryA` and `GetProcAddress`. What is the most appropriate conclusion?

   • AThe binary is a DLL because it imports `LoadLibraryA` and `GetProcAddress`.
   • BThe binary has no malicious functionality because it has very few imports.
   • CThe binary is packed with ASPack, and the imports are likely used by the unpacking stub to load additional APIs dynamically.
   • DThe binary is a clean executable that uses dynamic API resolution for legitimate purposes.
   Reveal Solution Discussion Select an answer first