GREM 試験問題を無料オンラインアクセス

When analyzing a function in assembly language, how can you identify the function's parameters?

• A.By looking for direct register assignments at the start of the function
• B.By identifying the first arithmetic instructions in the function
• C.By locating values pushed onto the stack immediately before a call instruction
• D.By counting the number of RET instructions

What is the main purpose of using the SetWindowsHookEx function in malware?

• A.To generate cryptographic keys
• B.To compress data
• C.To intercept and monitor system messages or events
• D.To allocate memory within a process

In the context of malware analysis, what is the significance of detecting packed or encrypted sections within a binary?

• A.It suggests a possible attempt to obfuscate the code.
• B.It means the binary is self-documenting.
• C.It indicates that the binary is likely benign.
• D.It signifies that the binary requires network access to execute.

What would an analyst be looking for when examining the import address table (IAT) of a Windows PE file during malware analysis?

• A.The list of DLLs and functions that the executable will use
• B.Debugging information
• C.The checksum of the file for integrity verification
• D.Metadata regarding the file's original creation date

Which section in a PDF file typically stores the most important structure and object references for analysis?

• A.Catalog
• B.Stream
• C.Info
• D.Trailer