During dynamic analysis of a malicious macro, the analyst notices that the macro checks for the presence of a file named 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe' and exits if it exists. What is the macro likely doing?

Detecting a virtual machine environment and avoiding execution in sandboxes.

Checking for a specific application that is required for the payload to run.

Ensuring that the macro runs only on systems with VMware installed.

Verifying that the system has enough disk space for the payload.

An analyst is setting up a sandbox for macro analysis. The macro is known to use anti-sandbox techniques such as checking for the presence of analysis tools (e.g., Wireshark, ProcMon) and checking the system's hostname. The analyst wants to maximize the chance of the macro executing. Which configuration is most effective?

Use a clean VM with a generic hostname, no analysis tools installed, and spoofed hardware identifiers

Use a VM with all analysis tools installed and a realistic hostname

Use a bare-metal host with analysis tools installed

Use a VM with a hostname that includes 'sandbox' to appear legitimate

An analyst is investigating a macro that appears to be a new variant of a known malware family. The analyst wants to confirm the family and find related samples. Which combination of artifacts would be most useful for this purpose?

The macro's unique strings and the URL it contacts.

The document's metadata and the macro's obfuscation routines.

The file's icon and the document's page count.

The VBA project's password and the document's language.

A macro uses a legitimate Windows utility (e.g., msiexec.exe) to download and execute a payload. The analyst wants to observe the command line arguments used. Which approach is most effective?

Use a VBA emulator to log the Shell calls.

Use a debugger to break on the CreateProcess API.

Use a process monitoring tool to capture the command line of child processes.

Use a network sniffer to capture the payload being downloaded.

A security team wants to analyze a suspicious macro without using a full operating system VM. They need to observe the macro's behavior in a safe, repeatable manner. Which tool is specifically designed for this purpose?

Use a debugger like x64dbg to step through the macro code.

Use a VBA emulator like ViperMonkey to simulate macro execution.

Use a network sniffer like Wireshark to capture traffic from the macro.

Use a file monitor like ProcMon to watch file system changes.

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 5)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 21–25

21application · medium
During dynamic analysis of a malicious macro, the analyst notices that the macro checks for the presence of a file named 'C:\Program Files\VMware\VMware Tools\vmtoolsd.exe' and exits if it exists. What is the macro likely doing?
Select an answer first
22expert · hard
An analyst is setting up a sandbox for macro analysis. The macro is known to use anti-sandbox techniques such as checking for the presence of analysis tools (e.g., Wireshark, ProcMon) and checking the system's hostname. The analyst wants to maximize the chance of the macro executing. Which configuration is most effective?
Select an answer first
23expert · hard
An analyst is investigating a macro that appears to be a new variant of a known malware family. The analyst wants to confirm the family and find related samples. Which combination of artifacts would be most useful for this purpose?
Select an answer first
24expert · hard
A macro uses a legitimate Windows utility (e.g., msiexec.exe) to download and execute a payload. The analyst wants to observe the command line arguments used. Which approach is most effective?
Select an answer first
25application · medium
A security team wants to analyze a suspicious macro without using a full operating system VM. They need to observe the macro's behavior in a safe, repeatable manner. Which tool is specifically designed for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.