Which of the following is an example of an IOC that can be extracted from a malicious macro?

A URL to a command-and-control server

During dynamic analysis, a macro checks the system's local time and only executes its payload if the current date is after a specific date. What is the most likely purpose of this check?

To ensure the system clock is synchronized with a time server.

To evade analysis by delaying execution until a specific date.

To check if the system is in a different time zone.

To schedule the payload to run at a specific time.

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 7)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 31–35

31foundation · easy
Which technique is commonly used to obfuscate strings in malicious VBA macros?
Select an answer first
32foundation · easy
Which of the following is an example of an IOC that can be extracted from a malicious macro?
Select an answer first
33foundation · easy
Which tool is specifically designed to extract and analyze VBA macros from Office documents?
Select an answer first
34foundation · easy
Which macro event triggers automatically when a Word document is opened?
Select an answer first
35application · medium
During dynamic analysis, a macro checks the system's local time and only executes its payload if the current date is after a specific date. What is the most likely purpose of this check?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious Office Macros GREM Practice Questions (Page 7)

Questions 31–35

Which technique is commonly used to obfuscate strings in malicious VBA macros?

Which of the following is an example of an IOC that can be extracted from a malicious macro?

Which tool is specifically designed to extract and analyze VBA macros from Office documents?

Which macro event triggers automatically when a Word document is opened?

During dynamic analysis, a macro checks the system's local time and only executes its payload if the current date is after a specific date. What is the most likely purpose of this check?

Keep studying — Document and File Analysis