A malicious macro is found to write a file to %TEMP% and then execute it. The macro also creates a registry run key to persist. Which of the following is a host-based IOC that can be used for detection?

The registry key path and the file name written to %TEMP%

While analyzing a malicious Word document, an analyst encounters a VBA function that builds a URL by concatenating several strings and then passes it to a function called 'Evaluate'. What is the most likely purpose of this obfuscation technique?

To prevent the macro from being detected by antivirus software that scans for suspicious URLs.

To ensure the URL is encoded in UTF-16 so it can be used in HTTP requests.

To hide the final URL from static string analysis and delay detection.

To make the macro compatible with older versions of Microsoft Office.

An analyst is examining a malicious .docm file and wants to find clues about the author or the tool used to create the document. Which artifact should the analyst examine?

The embedded images in the document.

The VBA project's password hash.

The document's metadata, such as author, company, and software version.

A user receives a .pptm file from an unknown sender. The user opens it, and a macro runs automatically, downloading a file. Which file format and macro execution trigger are involved?

A PowerPoint show file with a SlideShow_Start event

PowerPoint macro-enabled presentation with an Auto_Open or Presentation_Open event

Excel macro-enabled workbook with a Workbook_Open event

Word macro-enabled document with a Document_Open event

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 2)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 6–10

6application · medium
A malicious macro is found to write a file to %TEMP% and then execute it. The macro also creates a registry run key to persist. Which of the following is a host-based IOC that can be used for detection?
Select an answer first
7application · medium
While analyzing a malicious Word document, an analyst encounters a VBA function that builds a URL by concatenating several strings and then passes it to a function called 'Evaluate'. What is the most likely purpose of this obfuscation technique?
Select an answer first
8application · medium
An analyst is examining a malicious .docm file and wants to find clues about the author or the tool used to create the document. Which artifact should the analyst examine?
Select an answer first
9application · easy
A user receives a .pptm file from an unknown sender. The user opens it, and a macro runs automatically, downloading a file. Which file format and macro execution trigger are involved?
Select an answer first
10foundation · easy
Which VBA keyword is used to define a subroutine that does not return a value?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.