GREM sample questions

Question 1

A malware analyst is configuring a dedicated analysis lab using VMware Workstation. To ensure the malware can be analyzed dynamically while simulating Internet services without exposing the production network or the actual Internet, which network configuration is the MOST appropriate?

Accepted Answer

Configure a Host-Only network with a REMnux VM acting as the gateway and DNS/HTTP simulator

Answer

Bridge the malware VM to the host's physical network adapter

Answer

Use NAT (Network Address Translation) sharing the host's IP

Answer

Isolate the VM by removing all network adapters

Question 2

During the static analysis of a suspicious PE file named 'invoice.exe', you observe that the 'Virtual Size' of the `.text` section is 0x40000 bytes, while the 'Size of Raw Data' is 0 bytes. What is the most likely explanation for this anomaly?

Accepted Answer

The executable is packed, and the code will be unpacked into this section at runtime

Answer

The section contains uninitialized variables only

Answer

This is a normal characteristic of the .text section in 64-bit Windows executables

Answer

The file is corrupted and cannot execute

Question 3

While monitoring a malware sample with Process Monitor (ProcMon), you notice a repetitive operation where the process queries the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`. Immediately after, it creates a file named `update.exe` in `%APPDATA%`. Which phase of the malware lifecycle are you observing?

Accepted Answer

Persistence Mechanism Installation

Answer

Privilege Escalation

Answer

Command and Control Beaconing

Answer

Anti-Debugging Check

Question 4

You are analyzing a 32-bit assembly snippet in x64dbg. You encounter the following instructions:

```assembly
PUSH EBP
MOV EBP, ESP
SUB ESP, 10
MOV [EBP-4], 0
```

What is the purpose of the instruction `SUB ESP, 10` in this function prologue?

Accepted Answer

It allocates 0x10 (16 bytes) of space on the stack for local variables.

Answer

It cleans up 10 bytes of arguments from the stack.

Answer

It aligns the stack to a 16-byte boundary.

Answer

It saves the previous stack frame pointer.

Question 5

Examine the following x86 assembly block found in a malware sample:

```assembly
MOV ECX, 100
XOR EAX, EAX
LABEL_START:
ADD EAX, [EBX + ECX * 4]
DEC ECX
JNZ LABEL_START
```

Which high-level programming construct does this assembly block represent?

Accepted Answer

A Do-While loop iterating 100 times

Answer

A Switch statement

Answer

An If-Else conditional block

Answer

A recursive function call

Question 6

You are analyzing a function call in a 32-bit Windows malware sample. You see the following instructions:

```assembly
PUSH 0
PUSH 0
PUSH 0
PUSH 0
PUSH OFFSET Command
PUSH 0
CALL Kernel32.CreateProcessA
```

If the malware were compiled for a 64-bit Windows environment, how would the first four parameters be passed to `CreateProcessA` according to the Microsoft x64 calling convention?

Accepted Answer

They would be passed in registers RCX, RDX, R8, and R9.

Answer

They would still be pushed onto the stack in reverse order.

Answer

They would be passed in registers RDI, RSI, RDX, and RCX.

Answer

They would be passed via the XMM0-XMM3 registers.

Question 7

You encounter a routine that iterates through a byte array, performing an XOR operation on each byte with the key 0x5A. What is the primary purpose of this routine in the context of malware analysis?

Accepted Answer

To obfuscate or encrypt strings and configuration data to hide them from static analysis.

Answer

To compress the data for faster transmission.

Answer

To verify the integrity of the file (Checksum).

Answer

To calculate the entropy of the file.

Question 8

In x86 assembly, the `TEST` instruction is frequently used before a conditional jump. If you see `TEST EAX, EAX` followed by `JZ (Jump if Zero)`, what is the code checking?

Accepted Answer

It checks if EAX is zero.

Answer

It checks if EAX is equal to -1.

Answer

It compares EAX with the value at the memory address in EAX.

Answer

It sets EAX to zero.

Question 9

Which of the following assembly instructions is commonly used in shellcode to calculate the current instruction pointer (EIP) location dynamically, often referred to as 'get_pc' or 'get_eip' technique?

Accepted Answer

CALL followed by POP

Answer

MOV EAX, EIP

Answer

LEA EAX, [ESP]

Answer

JMP EIP

Question 10

You are reverse engineering a downloader that uses `URLDownloadToFileW`. The second parameter is the URL. In the disassembly, you see `PUSH EAX` before the call, where EAX points to a wide string. What character encoding must this string use?

Accepted Answer

UTF-16 Little Endian (2 bytes per char)

Answer

ASCII (1 byte per char)

Answer

UTF-8

Answer

EBCDIC

Top vendors

Top exams

Free GREM sample questions

A malware analyst is configuring a dedicated analysis lab using VMware Workstation. To ensure the malware can be analyzed dynamically while simulating Internet services without exposing the production network or the actual Internet, which network configuration is the MOST appropriate?

During the static analysis of a suspicious PE file named 'invoice.exe', you observe that the 'Virtual Size' of the `.text` section is 0x40000 bytes, while the 'Size of Raw Data' is 0 bytes. What is the most likely explanation for this anomaly?

You are analyzing a 32-bit assembly snippet in x64dbg. You encounter the following instructions: ```assembly PUSH EBP MOV EBP, ESP SUB ESP, 10 MOV [EBP-4], 0 ``` What is the purpose of the instruction `SUB ESP, 10` in this function prologue?

Examine the following x86 assembly block found in a malware sample: ```assembly MOV ECX, 100 XOR EAX, EAX LABEL_START: ADD EAX, [EBX + ECX * 4] DEC ECX JNZ LABEL_START ``` Which high-level programming construct does this assembly block represent?

You encounter a routine that iterates through a byte array, performing an XOR operation on each byte with the key 0x5A. What is the primary purpose of this routine in the context of malware analysis?

In x86 assembly, the `TEST` instruction is frequently used before a conditional jump. If you see `TEST EAX, EAX` followed by `JZ (Jump if Zero)`, what is the code checking?

Which of the following assembly instructions is commonly used in shellcode to calculate the current instruction pointer (EIP) location dynamically, often referred to as 'get_pc' or 'get_eip' technique?

You are reverse engineering a downloader that uses `URLDownloadToFileW`. The second parameter is the URL. In the disassembly, you see `PUSH EAX` before the call, where EAX points to a wide string. What character encoding must this string use?

10 more free samples are waiting