GIAC
GREM · Question #3
You are analyzing malware and notice a complex sequence of conditional branches and JMP instructions. The malware seems to randomly alter its execution flow based on certain conditions. What steps…
The correct answer is A. Step through the code in a debugger to observe how each condition is handled. C. Analyze the malware's memory during execution to observe the effects of conditional statements. D. Trace the instructions executed before and after each JMP instruction. See the full explanation below for the reasoning.
Question
You are analyzing malware and notice a complex sequence of conditional branches and JMP instructions. The malware seems to randomly alter its execution flow based on certain conditions. What steps should you take to fully understand its behavior? (Choose three)
Options
- AStep through the code in a debugger to observe how each condition is handled.
- BModify the malware's code to disable all JMP instructions.
- CAnalyze the malware's memory during execution to observe the effects of conditional statements.
- DTrace the instructions executed before and after each JMP instruction.
- ERun the malware in a sandbox environment to observe its network traffic.
How the community answered
(44 responses)- A84% (37)
- B5% (2)
- E11% (5)
Community Discussion
No community discussion yet for this question.