最新のGREM問題集で試験を準備する

When analyzing .NET malware, which of the following findings would be considered significant?
(Choose Three)

• A. Embedding of native DLLs within the .NET assembly
• B. Usage of standard .NET libraries for file operations
• C. Custom attributes that seem irrelevant to the application's core functionality
• D. Presence of P/Invoke (Platform Invocation Services) calls
• E. Use of obfuscation to hinder decompilation

In malware analysis, what is the purpose of comparing the hash of a suspicious file to known malware databases?

• A. To potentially identify the malware and its known behaviors
• B. To identify the file's original author
• C. To understand the network behavior of the malware
• D. To determine the exact changes made to the system by the malware

What is the primary reason attackers pack malware binaries?

• A. To make it harder for analysts to reverse-engineer the malware
• B. To bypass network-based detection systems
• C. To optimize the code for execution
• D. To hide the true size of the malware

API hooking implemented by malware is primarily used for which purpose?

• A. Increasing the speed of the malware execution
• B. Simplifying the malware code
• C. Intercepting and possibly altering the function calls, messages, or events passed between software components
• D. Making the malware more detectable

Which of the following is the MOST reliable indicator that the payload is unpacked?

• A. API calls are resolved
• B. New thread is created
• C. Strings become readable
• D. Full PE header appears in memory