In the context of malware analysis, what does the term "patching" refer to?

Modifying a compiled executable to change its functionality without having to recompile it.

Installing software updates that address vulnerabilities in installed software.

Setting memory breakpoints by modifying access flags on memory segments.

Stepping through the executable without running every instruction within function calls.

Modifying a compiled executable to change its functionality without having to recompile it.

Which mechanism is malware least likely to use when defending itself against analysis?

Employing polarization techniques

Inserting junk code instructions

Employing polarization techniques

Making use of "tricky" jump instructions

Detecting the presence of a debugger

Which of the following defensive measures do malware authors use to encode the original executable to protect it against static code analysis?

Packing the malicious executable

Employing fast-flux DNS techniques

Embedding an imports table in the malicious executable

Targeting client-side vulnerabilities

Packing the malicious executable

Which of the following Windows registry keys is most useful for malware that aims at maintaining persistent presence on the infected system?

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKCU\System\CurrentControlSet\Control\MediaProperties

What are the two most common phases of malware analysis?

Identification and containment analysis

Registry and file system analysis

What's Your Malware Analysis Process? Quiz

1.

Which of the following tools best supports the concept of breakpoints?
- A.
  
  Debugger
- B.
  
  Disassembler
- C.
  
  Sniffer
- D.
  
  Logger
Correct Answer
A. Debugger

Explanation
A debugger lets the malware analyst step through the most interesting parts of the code, interacting with it and observing the effects of its instructions to understand their purpose. A breakpoint is a condition, defined by the analyst, that tells the debugger when it should pause the execution of the program, giving the analyst an opportunity to interact with the program with the help of the debugger's capabilities.

Rate this question:
2.

Which x86 register is most commonly used for storing a function's return value in assembler?
- A.
  
  ECX
- B.
  
  EIP
- C.
  
  EAX
- D.
  
  EFLAGS
Correct Answer
C. EAX

Explanation
The x86 instruction set supports several general-purpose registers. EAX is one of them. Although general-purpose registers could be used by the program for any purpose, EAX is often used as the placeholder for storing the return value of a function.

Rate this question:
3.

In the context of malware analysis, what does the term "patching" refer to?
- A.
  
  Installing software updates that address vulnerabilities in installed software.
- B.
  
  Setting memory breakpoints by modifying access flags on memory segments.
- C.
  
  Stepping through the executable without running every instruction within function calls.
- D.
  
  Modifying a compiled executable to change its functionality without having to recompile it.
Correct Answer
D. Modifying a compiled executable to change its functionality without having to recompile it.

Explanation
Malware analysts frequently patch the malicious program to modify how it executes, even though they typically don't have access to the program's original source code. For instance, the analyst might locate a defensive measure built into the specimen to confuse the analyst, and use patching to render that measure ineffective.

Rate this question:
4.

Which of the following assembly instructions is least likely to be used by malicious code to perform a jump?
- A.
  
  JMP
- B.
  
  XOR
- C.
  
  RET
- D.
  
  CALL
Correct Answer
B. XOR

Explanation
Malicious code typically uses assembly instructions like JMP, RET, and CALL to perform jumps and alter the flow of execution. However, XOR is least likely to be used for this purpose. XOR is primarily used for bitwise operations and data manipulation, rather than controlling program flow. It is less commonly used for branching or jumping within a program, making it an unlikely choice for malicious code seeking to perform a jump.

Rate this question:
5.

Which mechanism is malware least likely to use when defending itself against analysis?
- A.
  
  Inserting junk code instructions
- B.
  
  Employing polarization techniques
- C.
  
  Making use of "tricky" jump instructions
- D.
  
  Detecting the presence of a debugger
Correct Answer
B. Employing polarization techniques

Explanation
Malware authors often take measures to slow down, confuse, or misdirect the reverse-engineer. There are numerous self-defending tricks to accomplishing this, including inserting unnecessary (junk) instructions into the program, jumping by using unusual instructions and also identifying the presence of the analyst's debugger. The term "polarization" doesn't correspond to a valid technique.

Rate this question:
6.

Which of the following defensive measures do malware authors use to encode the original executable to protect it against static code analysis?
- A.
  
  Employing fast-flux DNS techniques
- B.
  
  Embedding an imports table in the malicious executable
- C.
  
  Targeting client-side vulnerabilities
- D.
  
  Packing the malicious executable
Correct Answer
D. Packing the malicious executable

Explanation
By using a "packing" utility, malware authors encode, encrypt or obfuscate the original executable, making it more difficult to analyze using static code analysis techniques. In such cases, the reverse-engineer typically has to unpack the program using a variety of approaches that might be challenging and time-consuming.

Rate this question:
7.

Which of the following terms refers to a field in the PE header that specifies the address of the instruction that the OS should execute first after loading the executable?
- A.
  
  Starting Point
- B.
  
  Point of Origin
- C.
  
  Entry Point
- D.
  
  Thread Origination Point
Correct Answer
C. Entry Point

Explanation
The PE ("Portable Executable") header of a Windows executable stores critical information about the program that allows the Windows operating system to properly run the executable. One of the fields stores in the header is the Entry Point. This field stores the address of the instruction within the program that the operating system needs to execute first to begin running the program.

Rate this question:
8.

Which of the following system calls is most likely to be used by a keylogger?
- A.
  
  GetProcAddress
- B.
  
  VirtualAllocEx
- C.
  
  POP
- D.
  
  GetAsyncKeyState
Correct Answer
D. GetAsyncKeyState

Explanation
GetAsyncKeyState determines whether the specified key is pressed at the moment when this system call is made. One of the ways a keylogger can spy on the user's keyboard activities is to repeatedly iterate through all likely key values, checking whether each key is pressed.

Rate this question:
9.

Which of the following Windows registry keys is most useful for malware that aims at maintaining persistent presence on the infected system?
- A.
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- B.
  
  HKLM\SECURITY
- C.
  
  %UserProfile%\ntuser.dat
- D.
  
  HKCU\System\CurrentControlSet\Control\MediaProperties
Correct Answer
A. HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Explanation
A malicious program usually wants to ensure that it continues to run on the system even after a reboot. There are numerous ways of accomplishing this, including adding an entry to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key that points to the specimen's file.

Rate this question:
10.

What are the two most common phases of malware analysis?
- A.
  
  Behavioral and code analysis
- B.
  
  Identification and containment analysis
- C.
  
  Registry and file system analysis
- D.
  
  User and kernel mode analysis
Correct Answer
A. Behavioral and code analysis

Explanation
Behavioral analysis examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes and OS components. As the malware investigator notices interesting behavioral characteristics, he or she modifies the laboratory environment to evoke new characteristics. Code analysis reverse-engineers the malicious program to understand the code that implements the specimen's behavior. When looking at compiled programs, this process involves using a disassembler, a debugger and, perhaps, a decompiler to examine the program's low-level assembly or byte-code instructions.

Rate this question:

What's Your Malware Analysis Process? Quiz

Which of the following tools best supports the concept of breakpoints?

Which x86 register is most commonly used for storing a function's return value in assembler?

In the context of malware analysis, what does the term "patching" refer to?

Which of the following assembly instructions is least likely to be used by malicious code to perform a jump?

Which mechanism is malware least likely to use when defending itself against analysis?

Which of the following defensive measures do malware authors use to encode the original executable to protect it against static code analysis?

Which of the following terms refers to a field in the PE header that specifies the address of the instruction that the OS should execute first after loading the executable?

Which of the following system calls is most likely to be used by a keylogger?

Which of the following Windows registry keys is most useful for malware that aims at maintaining persistent presence on the infected system?

What are the two most common phases of malware analysis?