While analyzing a malicious Word document, an analyst finds a VBA module that contains a function named 'DecodeString' that takes a string and performs XOR operations. The function is called from multiple procedures. What is the most likely purpose of this function?

To validate the integrity of the macro's code.

To compress the strings to reduce the macro's size.

To convert strings to Unicode for compatibility with Windows APIs.

To obfuscate strings that are used as payloads or commands.

What is the purpose of using 'variable renaming' as an obfuscation technique in malicious macros?

To improve the performance of the macro

To avoid triggering antivirus signatures

To make the macro compatible with different Office versions

To make the code harder to understand for analysts

Which of the following is a common anti-analysis technique used by malicious macros to detect virtual machines?

Checking the macro security settings

Checking for the presence of VMware tools

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 11)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 51–55

51foundation · easy
Which tool is commonly used to monitor file system and registry changes during dynamic analysis of a macro?
Select an answer first
52foundation · easy
In which Office application would a file with the .xlsm extension be opened?
Select an answer first
53application · medium
While analyzing a malicious Word document, an analyst finds a VBA module that contains a function named 'DecodeString' that takes a string and performs XOR operations. The function is called from multiple procedures. What is the most likely purpose of this function?
Select an answer first
54foundation · easy
What is the purpose of using 'variable renaming' as an obfuscation technique in malicious macros?
Select an answer first
55foundation · easy
Which of the following is a common anti-analysis technique used by malicious macros to detect virtual machines?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 11)

Questions 51–55

Which tool is commonly used to monitor file system and registry changes during dynamic analysis of a macro?

In which Office application would a file with the .xlsm extension be opened?

While analyzing a malicious Word document, an analyst finds a VBA module that contains a function named 'DecodeString' that takes a string and performs XOR operations. The function is called from multiple procedures. What is the most likely purpose of this function?

What is the purpose of using 'variable renaming' as an obfuscation technique in malicious macros?

Which of the following is a common anti-analysis technique used by malicious macros to detect virtual machines?

Keep studying — Document and File Analysis