Scribd Logo
Upload

Welcome to Scribd!

  • 4 views

    Malware Quiz

    Uploaded by

    MAJID ABDULLAH

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Malware Quiz

    Uploaded by

    MAJID ABDULLAH
    4 views5 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    4 views5 pages

    Malware Quiz

    Uploaded by

    MAJID ABDULLAH

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 5

    1-What is an hardware breakpoint?

    A.it allows to know health status of the machine


    B.Breaks on an address rading / writing, instead of on an EIP position
    C.Breaks on EIP position
    D.it is the same as the software breakpoint, it only breaks header and more precisely

    2-what does this assembly do push 0x500000 Ret


    A.it pushes value 0x500000 to the stack and return
    B. It jumps to the address 0x500000
    C.it removes value 0x500000 from the stack
    D.it does no operation, just return

    3-how would you debug a DLL function for dynamic analysis? Check all boxes that apply
    A.simply run the DLL from command line or by double-clicking
    B.write a simple C loader
    C.use rundll32.exe
    D.user cmd.exe

    4-what is the link between Kernel32.dll, ntdll.dll and the kernel?


    A.ntdll calls functions from kernel32.dll which is the kernel and return result of execution
    B.most functions from kernel32 call one from ntdll, which handles the syscall to call the
    kernel
    C.the kernel calls kernel32.dll function which proxy calls to ntdll to relay to user land
    D.there is no link between those entities, all are independent
    5-how can a malware hide its import, using 2 functions from the win32 API? Check all boxes
    that apply
    A.loadfile
    B.loadlibraryA
    C.getprocaddress
    D.openprocess
    6- What does virtual protect do ?
    A.Encrypt the code in disassembly
    B.Alter the code at each instruction to protect from disassembly
    C.Modify memory page permission
    D.It helps protects the analyst machine

    7-how is passed the "this" pointer in assembly?


    A.EAX register
    B.ECX register
    C.EIP register
    D.in the stack

    8-can the .data section contain code?


    A.Yes
    B.No

    9-which function could be used in Process injection scenario


    A.URLDownloadToFile()
    B.ShellExecute()
    C.CreateRemoteThread()
    D.FileOpen()

    10-what is located at address fs[0x30] in windows 32 bits?


    A.EAX
    B.OEP
    C.RIP
    D.PEB
    11-which function call should you monitor when dealing with process hollowing? Check all
    boxes that apply
    A.CreateProcess
    B.FileOpen
    C.WriteProcessMemory
    D.NtResumeThread

    12-how can you run and debug a shellcode? Check all boxes that apply
    A.just run the malware, shellcode will execute to debug
    B.using scdbg tool to debug the shellcode and extract functions calls
    C.simple C program, place the shellcode in an array, and call it with a function pointer
    D.with a DLL loader

    13-what are the 2 first bytes of a PE file?


    A.'PE'
    B.'MZ'
    C.'X64'
    D.'EXE

    14-which instruction does shellcode often use to push all registers on the stack?
    A.noop
    B.push
    C.put
    D.db

    15-what libraries are always loaded, regardless of the PE header ? Check all boxes that apply
    A.kernel32.dll
    B.winnt.dll
    C.ntdll.dll
    D.user32.dll
    16-how can you know that one class inherits from another one?
    A.the mother class owns the daughter methods
    B.the mother class constructor is called by the daughter
    C.the daughter class name is prefixed by mother class
    D.all methods are the same between classes

    17-what is executed before a.exe entrypoint?


    A.search for kernel32.dll
    B.Dllmain of each loaded DLLs
    C.places the address of virtualalloc in eax
    D.erase all pointer values

    18-where are stored the vtable in the class structure?


    A.offset 0
    B.at the end of the class
    C.at offset 0x30
    D.there is no vtable in the class structure

    19-how can a malware detect a debugger? Check all boxes that apply
    A.IsDebuggerPresent
    B.Detection of usage of CreateRemoteThread()
    C.when there is a debugger, malware will not load
    D.Breakpoint detection (0xCC)
    20-what does this assembly do?
    Begin:
    Call next
    Db "VirtualAlloc", 0
    Next:
    Pop eax
    A.it places the address of virtualalloc in eax
    B.it erases virtualalloc
    C.it calls function virtualalloc with EAX in parameter
    D.it removes content of EAX

    You might also like