최신 GREM 무료덤프 - GIAC Reverse Engineering Malware
Which of the following is a common persistence mechanism used by malware?
정답: A
In assembly language analysis, what is typically the purpose of the EBP register within a function?
정답: A
In the context of overcoming misdirection techniques, why is single-stepping through code important?
정답: D
Which of the following is a common technique used by attackers to exploit vulnerabilities in RTF files?
정답: A
Which tool is most commonly used to analyze JavaScript embedded within a malicious PDF?
정답: D
What is a common sign that a PDF might be malicious?
정답: A
What is the primary purpose of analyzing loops in a malware sample?
정답: D
Which of the following techniques can be used to defeat code obfuscation in malware?
정답: B
What does it imply if a .NET malware sample contains calls to the
System.Reflection.Assembly.Load method?
System.Reflection.Assembly.Load method?
정답: A
A malware dynamically allocates RWX memory and copies code into it. What is the BEST indication for next analysis step?
정답: B
Which of the following is the MOST reliable indicator that the payload is unpacked?
정답: D
What characteristic feature would analysts typically NOT expect to find in packed malware?
정답: C
You are analyzing a malware sample that appears to inject malicious code into the explorer.exe process. During execution, the malware creates a remote thread in explorer.exe and uses API calls to manipulate its memory.
How would you proceed with the analysis? (Choose three)
How would you proceed with the analysis? (Choose three)
정답: B,D,E
Which technique can be utilized to hide malicious macro code within an Office document?
정답: A
Which condition MOST strongly confirms reflective DLL loading?
정답: B