An analyst is reviewing VBA code extracted from a malicious document. The code has multiple modules, including one named "Module1" that contains a function called "Decode" and another module named "Module2" that contains a subroutine called "Main". The Main subroutine calls Decode and then uses the result to write a file. What is the likely purpose of separating the code into modules?

To improve the performance of the macro

To hide the malicious code from antivirus scanners

To allow the macro to run in different Office applications

To organize the code and make it harder to follow during analysis

What is the purpose of extracting IOCs from a malicious macro?

To support detection and response efforts

To determine the document's file format

To make the macro more difficult to analyze

To improve the macro's performance

A malware analyst is setting up a dynamic analysis environment for Office macros. The analyst needs to observe network traffic and file system changes, but the macro uses anti-VM checks that detect common VMware artifacts. The analyst has limited resources and cannot use a full hardware-based sandbox. Which approach best balances safety, observability, and evasion of anti-VM checks?

Use a VM without VMware Tools, modify VM artifacts, and use a network simulator like INetSim.

Use a VBA emulator like ViperMonkey and ignore network and file monitoring.

Use a VM with VMware Tools installed and rely on network and file monitoring tools.

Use a physical machine with a clean OS and network monitoring.

An analyst is examining a malicious document and finds an embedded OLE object that is not a typical Office document. The analyst uses oledump to list the streams and notices a stream named "\x01Ole10Native". What does this indicate?

The document contains an embedded file, possibly an executable, that can be extracted

The document contains a malicious VBA macro

The document has a custom XML part

The document is digitally signed

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 4)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 16–20

16application · medium
An analyst is reviewing VBA code extracted from a malicious document. The code has multiple modules, including one named "Module1" that contains a function called "Decode" and another module named "Module2" that contains a subroutine called "Main". The Main subroutine calls Decode and then uses the result to write a file. What is the likely purpose of separating the code into modules?
Select an answer first
17foundation · easy
What is the purpose of extracting IOCs from a malicious macro?
Select an answer first
18expert · hard
A malware analyst is setting up a dynamic analysis environment for Office macros. The analyst needs to observe network traffic and file system changes, but the macro uses anti-VM checks that detect common VMware artifacts. The analyst has limited resources and cannot use a full hardware-based sandbox. Which approach best balances safety, observability, and evasion of anti-VM checks?
Select an answer first
19expert · medium
An analyst is examining a malicious document and finds an embedded OLE object that is not a typical Office document. The analyst uses oledump to list the streams and notices a stream named "\x01Ole10Native". What does this indicate?
Select an answer first
20foundation · easy
Which metadata field in an Office document can provide clues about the author of a malicious macro?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 4)

Questions 16–20

What is the purpose of extracting IOCs from a malicious macro?

An analyst is examining a malicious document and finds an embedded OLE object that is not a typical Office document. The analyst uses oledump to list the streams and notices a stream named "\x01Ole10Native". What does this indicate?

Which metadata field in an Office document can provide clues about the author of a malicious macro?

Keep studying — Document and File Analysis