An analyst is performing dynamic analysis of a malicious .docm file in a controlled VM. The macro is known to download a payload from a URL. Which tool or method is most appropriate to observe the network connection and capture the payload?

Use a debugger like x64dbg to step through the VBA code

Use a memory dump tool like Volatility to analyze the VM's memory

Use a network proxy like Fiddler or a packet capture tool like Wireshark

Use a file system monitor like ProcMon to watch for file writes

An analyst is examining a malicious Excel file and notices that it contains an embedded OLE object that is not a worksheet. What should the analyst do to investigate this embedded object?

Open the object in Excel to see what it does.

Ignore the object because it is not related to the macro.

Extract the embedded object using olevba or 7-Zip and analyze it separately.

Delete the object to prevent it from executing.

An analyst receives a suspicious .docm file from a phishing email. Using olevba, the analyst extracts VBA source code that contains a large array of integers and a loop that converts each integer to a character using Chr() and concatenates the results into a string. The resulting string is then passed to the Shell() function. What is the most likely purpose of the integer array and the loop?

To store a decryption key for an embedded encrypted payload

To compute a hash of the document for anti-analysis purposes

To generate a random filename for a dropped executable

To obfuscate a command line that will be executed by the macro

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 10)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 46–50

46foundation · easy
Which VBA method is commonly used to download a file from the internet in a malicious macro?
Select an answer first
47foundation · easy
Which file extension is most commonly associated with a Word document that contains macros?
Select an answer first
48application · easy
An analyst is performing dynamic analysis of a malicious .docm file in a controlled VM. The macro is known to download a payload from a URL. Which tool or method is most appropriate to observe the network connection and capture the payload?
Select an answer first
49application · medium
An analyst is examining a malicious Excel file and notices that it contains an embedded OLE object that is not a worksheet. What should the analyst do to investigate this embedded object?
Select an answer first
50application · medium
An analyst receives a suspicious .docm file from a phishing email. Using olevba, the analyst extracts VBA source code that contains a large array of integers and a loop that converts each integer to a character using Chr() and concatenates the results into a string. The resulting string is then passed to the Shell() function. What is the most likely purpose of the integer array and the loop?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 10)

Questions 46–50

Which VBA method is commonly used to download a file from the internet in a malicious macro?

Which file extension is most commonly associated with a Word document that contains macros?

An analyst is performing dynamic analysis of a malicious .docm file in a controlled VM. The macro is known to download a payload from a URL. Which tool or method is most appropriate to observe the network connection and capture the payload?

An analyst is examining a malicious Excel file and notices that it contains an embedded OLE object that is not a worksheet. What should the analyst do to investigate this embedded object?

Keep studying — Document and File Analysis