Malware Analysis Tools and Techniques: Windows Malware
29 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does a handle point to in memory?

  • File content
  • I/O devices
  • Arithmetic operations
  • Location in memory (correct)

    • Which function is used to create or open files?

  • CreateWindowEx
  • WriteFile
  • ReadFile
  • CreateFile (correct)

    • What do ReadFile and WriteFile operate on as a stream?

  • Memory locations
  • Files (correct)
  • Pointers
  • Handles

    • What does CreateFileMapping allow for?

    <p>Direct file manipulation</p> Signup and view all the answers

    What does MapViewOfFile return a pointer to?

    <p>Base address of the mapping</p> Signup and view all the answers

    Can arithmetic operations be performed on handles?

    <p>No</p> Signup and view all the answers

    What term is used to refer to the base address in the Windows registry?

    <p>Root Key</p> Signup and view all the answers

    What is the primary purpose of using the pointer to the base address in the Windows registry?

    <p>Jump around the file easily</p> Signup and view all the answers

    Which of the following is NOT a common use of the Windows registry according to the text?

    <p>Application installation</p> Signup and view all the answers

    How many top-level sections are there in the Windows registry referred to as root keys or hives?

    <p>Five</p> Signup and view all the answers

    What is a Key in the Windows registry analogous to?

    <p>Subfolder</p> Signup and view all the answers

    How does malware interact with the operating system?

    <p>Via Application Programing Interface (API)</p> Signup and view all the answers

    Which naming convention does Windows use for API function identifiers?

    <p>Hungarian Notation</p> Signup and view all the answers

    What is the purpose of Handles in Windows OS?

    <p>To represent opened items like windows, processes, files, etc.</p> Signup and view all the answers

    Which type does the prefix 'dw' indicate in Hungarian Notation used by Windows?

    <p>Double Word (DWORD) variables</p> Signup and view all the answers

    What makes it easy to identify the type of a variable in Hungarian Notation?

    <p>Using a prefix naming scheme</p> Signup and view all the answers

    Which of the following represents 16 bits according to Hungarian Notation in Windows?

    <p>WORD</p> Signup and view all the answers

    What API call is used to initialise a connection to the internet?

    <p>InternetOpen</p> Signup and view all the answers

    What function is typically used to download a file from the internet in two steps?

    <p>URLDownloadToFile()</p> Signup and view all the answers

    Which WIN32 API function is commonly used to create a new process?

    <p>CreateProcess</p> Signup and view all the answers

    What does the STARTUPINFO parameter in CreateProcess include?

    <p>Handle to standard input, output and error messages</p> Signup and view all the answers

    How can malicious programs use standard input, output, and error messages?

    <p>Set them to a socket for remote shell execution</p> Signup and view all the answers

    What type of properties can a parent process specify for its child process?

    <p>Window properties</p> Signup and view all the answers

    What is the primary purpose of key loggers?

    <p>Monitor user key strokes</p> Signup and view all the answers

    What are the two most common methods used by key loggers?

    <p>Install a hook for keyboard events and poll keyboard state with GetAsyncKeyState()</p> Signup and view all the answers

    What is the purpose of a hook procedure in the context of key loggers?

    <p>Intercept events like messages, mouse actions, and keystrokes</p> Signup and view all the answers

    Which API function is used to intercept keyboard events and relay them to a malicious function?

    <p>SetWindowsHookExA with WH_KEYBOARD parameter</p> Signup and view all the answers

    What does malware do in the context of polling the keyboard?

    <p>Goes into a loop and polls the state of every key</p> Signup and view all the answers

    Which function is called to get the state of a specific key during polling?

    <p>GetAsyncKeyState</p> Signup and view all the answers

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser