A. VM introspection
B. Encryption routine
C. Code signing
D. Persistence payload
A. Driver loading
B. Persistence creation
C. C2 configuration retrieval
D. Sandbox / VM detection
A. Availability of up-to-date anti-malware solutions
B. High-speed internet access without any filtering
C. Tools for both static and dynamic analysis
D. The capability to restore machines to a clean state
E. Restricted access control
A. It indicates the use of reflective programming to inspect or modify itself at runtime.
B. It implies the malware is likely to use graphics and visual effects.
C. It denotes the malware's capability to self-replicate.
D. It suggests the application is using a third-party .NET library.
A. POP
B. CALL
C. XOR
D. JMP
A. New thread is created
B. Strings become readable
C. Full PE header appears in memory
D. API calls are resolved
A. To allocate memory with specific access rights
B. To ensure data execution prevention (DEP)
C. To reserve a region of memory within a foreign process
D. To extend the size of a virtual memory page
A. Identifying embedded media files
B. Verifying the document formatting
C. Detecting potential shellcode or obfuscated content
D. Confirming standard RTF headers
A. It triggers security warnings when opened.
B. The file size is smaller than average for similar documents.
C. The PDF is viewable on multiple platforms.
D. It contains extensive text and few images.
A. To check for time-based triggers within the malware
B. To assess the file's relevance to a specific malware campaign
C. To determine the malware's expiration date
D. To understand when the malware was created or last modified
A. Monitor registry changes using a tool like Procmon
B. Reboot the system and observe if the malware starts again
C. Debug the malware to locate its API calls
D. Capture the DNS traffic using a network sniffer tool
E. Isolate the system and run the malware with network access disabled
A. To inspect the graphical user interface of the application
B. To identify the high-level language in which the program was originally written
C. To analyze network traffic generated by the malware
D. To understand the logic and flow of the program
A. To observe the malware's interaction with its environment in real-time
B. To gather information about the malware without executing it
C. To immediately identify and delete malware from the system
D. To determine the internet domains to which the malware communicates
