GIAC Reverse Engineering Malware 認定 GREM 試験問題:

1. What is the primary goal of obfuscating malware code?

A) To make the malware more difficult to detect and analyze
B) To reduce the size of the malware
C) To increase the speed of execution
D) To encrypt the payload during transmission

2. How can malware attempt to detect and respond to being run in a virtual machine? (Choose Three)

A) Checking the MAC address for known VM vendor OUIs
B) Attempting to write to known read-only memory locations
C) Enumerating running processes for VM-associated names
D) Measuring the disk access time
E) Looking for the presence of specific device drivers

3. What is the primary purpose of analyzing loops in a malware sample?

A) To understand the conditions for the malware's persistence or termination
B) To detect the presence of cryptographic routines
C) To quantify the malware's size
D) To determine the payload's execution frequency

4. Which technique is commonly used to obfuscate strings in malware?

A) Polymorphism
B) Packing
C) XOR encoding
D) Base64 encoding

5. You are performing static analysis on a suspicious Windows executable. The file has an unusual section labeled .rsrc and imports numerous suspicious DLLs, such as advapi32.dll. What steps should you take to gather more information? (Choose three)

A) Attempt to execute the file to see if it triggers any network activity.
B) Analyze the PE header to understand the executable's structure.
C) Review the imports to identify key functions that might suggest malicious behavior.
D) Use a tool like Strings to extract any readable text from the binary.
E) Perform dynamic analysis to observe the behavior when the executable is run.

質問と回答：