An analyst receives a suspicious .docm file from a phishing email. The analyst needs to quickly extract the embedded VBA source code without executing the document. Which tool and approach is most appropriate?

Open the document in Microsoft Word with macros enabled and review the Visual Basic Editor.

Use strings on the entire file and look for VBA keywords like 'Sub' and 'Function'.

Rename the file to .zip and extract the vbaProject.bin, then read it as plain text.

Use olevba to extract and display the VBA source code from the OLE streams.

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 12)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 56–56

56application · medium
An analyst receives a suspicious .docm file from a phishing email. The analyst needs to quickly extract the embedded VBA source code without executing the document. Which tool and approach is most appropriate?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 12)

Questions 56–56

An analyst receives a suspicious .docm file from a phishing email. The analyst needs to quickly extract the embedded VBA source code without executing the document. Which tool and approach is most appropriate?

Keep studying — Document and File Analysis