Static Analysis Fundamentals GREM Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which hashing algorithm produces a 256-bit digest and is commonly used for malware identification?

   • ASHA-1
   • BCRC32
   • CSHA-256
   • DMD5
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the primary purpose of the TrID tool in file identification?

   • ATo disassemble executable code
   • BTo extract strings from a binary
   • CTo compute cryptographic hashes of files
   • DTo identify file types based on statistical analysis of binary patterns
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   While performing static analysis on a malware sample, an analyst notices the string 'IsDebuggerPresent' in the import table and the string 'sandbox' in the .rdata section. The PE header's compilation timestamp is set to a date 10 years in the future. What is the most likely purpose of these combined indicators?

   • AThe malware is likely using anti-analysis techniques to evade debuggers and sandboxes.
   • BThe malware is packed, and these strings are part of the unpacking stub.
   • CThe malware is a legitimate debugging tool that checks for debuggers and sandboxes as part of its normal function.
   • DThe malware is designed to run only on systems with a debugger attached.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An analyst is comparing two malware samples from the same campaign. Sample A imports CreateRemoteThread, WriteProcessMemory, and VirtualAllocEx. Sample B imports only LoadLibraryA and GetProcAddress, and its import table is otherwise empty. Both samples have similar strings and the same compilation timestamp. What is the most likely relationship between the two samples?

   • ASample B is a newer version that uses different APIs for the same functionality.
   • BSample B is a completely different malware family that happens to share strings.
   • CSample B is a DLL that exports functions instead of importing them.
   • DSample B is packed, and its real imports will be revealed after unpacking, likely matching Sample A's imports.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A malware analyst is examining a PE file's import table and finds that it imports `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`, and `NtQueryInformationProcess`. What is the most likely purpose of these imports?

   • AThe sample contains anti-debugging techniques that attempt to detect if it is being analyzed.
   • BThe sample performs process injection by using these APIs to allocate memory in remote processes.
   • CThe sample is packed, and these imports are part of the unpacking stub.
   • DThe sample is a legitimate debugging tool that provides system information to users.
   Reveal Solution Discussion Select an answer first