最新的GIAC Reverse Engineering Malware - GREM免費考試真題

A. Behavioral sandboxing only

B. PE header re-alignment

C. Hash comparison with known malware

D. Dump memory after OEP is reached

A. It denotes that the malware is self-replicating.

B. It is a standard practice for all Windows applications for better performance.

C. It indicates the creation of a backup copy of the malware.

D. It signifies that the malware may be attempting process hollowing.

A. IDA Pro

B. Strings

C. Process Monitor

D. Wireshark

A. Frequent use of JavaScript best practices

B. Unusual or inconsistent formatting and encoding

C. Consistent use of meaningful variable names

D. Presence of detailed comments

A. Encrypting the macro with a password.

B. Embedding the macro within a non-macro document section.

C. Storing the macro in the document header.

D. Using excessive whitespace in the macro code.

A. Heap spraying

B. C2 hardcoding

C. Persistence

D. Self-extracting stub

A. To optimize the code for execution

B. To bypass network-based detection systems

C. To make it harder for analysts to reverse-engineer the malware

D. To hide the true size of the malware

A. It can be easily decompiled and modified.

B. It leverages a large set of managed libraries in the .NET Framework.

C. It can easily run on both Windows and Linux.

D. It can evade network-based detection tools.