GIAC Reverse Engineering Malware 認定 GREM 試験問題:

1. When analyzing .NET malware, which of the following findings would be considered significant?
(Choose Three)

A) Embedding of native DLLs within the .NET assembly
B) Usage of standard .NET libraries for file operations
C) Custom attributes that seem irrelevant to the application's core functionality
D) Presence of P/Invoke (Platform Invocation Services) calls
E) Use of obfuscation to hinder decompilation

2. In malware analysis, what is the purpose of comparing the hash of a suspicious file to known malware databases?

A) To potentially identify the malware and its known behaviors
B) To identify the file's original author
C) To understand the network behavior of the malware
D) To determine the exact changes made to the system by the malware

3. What is the primary reason attackers pack malware binaries?

A) To make it harder for analysts to reverse-engineer the malware
B) To bypass network-based detection systems
C) To optimize the code for execution
D) To hide the true size of the malware

4. API hooking implemented by malware is primarily used for which purpose?

A) Increasing the speed of the malware execution
B) Simplifying the malware code
C) Intercepting and possibly altering the function calls, messages, or events passed between software components
D) Making the malware more detectable

5. Which of the following is the MOST reliable indicator that the payload is unpacked?

A) API calls are resolved
B) New thread is created
C) Strings become readable
D) Full PE header appears in memory

質問と回答：