Common interview questions for a malware analyst career
The following questions include a heavier focus on the analysis of PE headers and questions around assembly language. From my own experience in interviews, the majority of questions I received for malware analyst positions were around PE headers:
- Can you name the common headers in a Portable Executable (PE) file?
The headers are the DOS header (struct_IMAGE_DOS_HEADER), NT header (struct_IMAGE_NT_HEADER), the file and optional headers that live within the NT header (struct__IMAGE_FILE_HEADER and struct__IMAGE_OPTIONAL_HEADER respectively), and the individual section headers (struct_IMAGE_SECTION_HEADER).
When opening an executable in a hex editor, the DOS header will occupy the first four rows (64 bits) in the hex editor and also include MZ in the magic number field.
The file header contains basic information about the file's layout and contains the following fields:
Table 8.1 ...
