Unit 3: Disassembly and Malware Debugging - Practice Quiz

1 What is static code analysis in malware analysis?

2 Which tool converts machine-code instructions into assembly language?

3 Which information can commonly be found by extracting strings from a suspicious binary?

4 What is the main purpose of calculating a cryptographic hash of a malware sample?

5 Which part of a Windows Portable Executable (PE) file lists external functions used by the program?

6 What does a Windows API call allow a program to do?

7 Which Windows API function is commonly associated with opening or creating a file?

8 Which Windows API function is commonly used to allocate virtual memory?

9 What is the purpose of GetProcAddress in Windows?

10 In disassembled code, which instruction commonly transfers control to a Windows API function?

11 What is debugging?

12 What is a breakpoint?

13 What does single-stepping allow an analyst to do?

14 Which processor component stores temporary values such as addresses and calculation results?

15 What does the instruction pointer normally identify?

16 Why should a suspicious binary be debugged in an isolated environment?

17 What does stepping into a function do in a debugger?

18 What does stepping over a function call usually do?

19 Which debugger feature can pause execution when a selected memory location is accessed?

20 What is the purpose of viewing the call stack while debugging a binary?

21 A suspicious Windows executable has very high entropy in its .text section and contains only a few readable strings. What is the most likely explanation?

22 During static analysis, a function repeatedly references the strings cmd.exe, /c, and CreateProcessW. What behavior should an analyst investigate first?

23 A disassembler incorrectly treats embedded data as executable instructions. Which action is most useful for correcting the analysis?

24 Why is examining cross-references to a suspicious string such as Software\\Microsoft\\Windows\\CurrentVersion\\Run useful?

25 An executable imports VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. Which capability is most strongly suggested by this combination?

26 In 32-bit x86 code using stdcall, several values are pushed immediately before a Windows API call. In what order are the function arguments normally pushed?

27 A binary imports only LoadLibraryA and GetProcAddress, but later performs network operations. Why might the network APIs be absent from its import table?

28 A call to CreateFileW returns 0xFFFFFFFF in the EAX register on a 32-bit system. How should this result usually be interpreted?

29 While analyzing a call to RegSetValueExW, which argument is most important for determining the actual data written to the registry value?

30 A disassembly shows calls to InternetOpenW, InternetConnectW, and HttpOpenRequestW. What behavior is most directly indicated?

31 Why might an analyst prefer a hardware execution breakpoint over a software breakpoint when examining self-checking malware?

32 What is the practical difference between stepping into and stepping over a CALL instruction?

33 A breakpoint set at a hard-coded virtual address works during one run but fails after restarting the program. Which Windows security feature most likely caused this?

34 A debugger reports a first-chance access violation, but the program continues normally after the exception is passed to it. What does this indicate?

35 Which breakpoint is most appropriate when an analyst wants execution to stop only when a buffer at a particular address is modified?

36 A packed binary decrypts its original code and then jumps into a newly readable code region. What should the analyst do near this transition?

37 After dumping an unpacked process from memory, the resulting executable does not run because its imported functions cannot be resolved. What is the likely next step?

38 A sample exits when IsDebuggerPresent returns a nonzero value. Which debugging action best allows analysis to continue while preserving the surrounding control flow?

39 A malware sample creates a child process and then terminates its original process. How should the analyst continue debugging the active behavior?

40 A loop executes thousands of times, but the analyst only wants to stop when register ECX becomes 0x20. What is the most efficient debugging technique?

41 A PE32+ sample is loaded at 0x00007FF700000000. A disassembler reports an instruction at RVA 0x2A3C0 containing call qword ptr [rip+0x195A]. The instruction is 6 bytes long. Which virtual address contains the 8-byte call target pointer?

42 A recursive-traversal disassembler misses a region that later executes, while a linear-sweep disassembler decodes many nonsensical instructions in the same region. Which code pattern best explains both observations?

43 In a 32-bit malware function, the sequence call next; next: pop esi; sub esi, 0x1050 is observed. The call instruction begins at RVA 0x2050 and is 5 bytes long. What value does ESI hold after the sub, assuming normal call semantics?

44 Static inspection shows a small import table, a writable and executable section with high entropy, and an entry point that repeatedly writes bytes into that section before branching there. Which conclusion is most defensible?

45 A PE file's declared entry point appears benign, but malicious initialization occurs before it. Which static structure should be examined first for code that the Windows loader may execute before the entry point?

46 Immediately before a Windows x64 call, the disassembly sets RCX to a process handle, RDX to a base address, R8 to a buffer, and R9 to a size. It stores a pointer at [rsp+0x20]. If the target is WriteProcessMemory, what does [rsp+0x20] represent?

47 A 32-bit call site pushes five arguments, executes call eax, and then immediately continues without adjusting ESP. Runtime inspection identifies EAX as CreateFileW. Which calling-convention inference is correct?

48 A sample walks loaded modules, parses export directories, hashes each exported name, and compares the result with embedded constants before calling the matched address. What is the primary analytical consequence?

49 While resolving an exported function manually, the export address-table entry points inside the export directory and contains the ASCII text KERNELBASE.CreateFileW. How should this entry be interpreted?

50 Disassembly shows calls to VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, all using the same process handle. Which interpretation best synthesizes the API sequence?

51 A debugger implements a software breakpoint by replacing the first byte of an instruction with 0xCC. After the breakpoint exception is reported on x86, what sequence is required to execute the original instruction exactly once and then restore the breakpoint?

52 A debugger receives a first-chance access-violation notification from a program that uses structured exception handling as normal control flow. What is the correct default interpretation?

53 You need to detect writes to a four-byte variable without modifying code or making its entire memory page read-only. Which mechanism is most appropriate on x86/x64?

54 A multithreaded sample intermittently bypasses a breakpoint because another thread restores the patched byte while the debugger is single-stepping the first thread. Which debugger strategy most directly prevents this race?

55 Single-stepping changes a malware sample's behavior because it compares timestamps around a short code region. Which response provides the strongest evidence that the timing check is anti-debugging rather than legitimate timeout logic?

56 A breakpoint was recorded at 0x0042F130 when a module loaded at 0x00400000. On the next run, ASLR loads the module at 0x6A100000. At what address should the breakpoint be placed?

57 A packed process has decrypted its original code, transferred control to a stable original entry point, and resolved APIs dynamically. To create a useful reconstructed PE, which action remains essential after dumping the process image?

58 A debugger stops on an execute access violation at a heap address. The bytes there form valid code that the sample just decoded, but the page protection is PAGE_READWRITE. What is the most likely immediate cause?

59 A 64-bit debugger attached to a WOW64 process reports transitions through both 32-bit user code and 64-bit system components. Why can register and breakpoint handling become misleading?

60 A self-modifying routine overwrites instructions that currently contain software breakpoints, causing missed events and corrupted decoded code. Which breakpoint strategy is most robust for the rewritten region?