Analyzing Malicious Office Macros GREM Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An analyst is analyzing a macro that uses a custom function to decode strings. The analyst has identified the decoding algorithm but the macro also uses dynamic code evaluation with the 'Eval' function. The analyst needs to extract the final payload URL. What is the most efficient approach?

   • APatch the macro to skip the Eval call and run it in Office.
   • BUse a VBA emulator to execute the macro and log the arguments passed to Eval.
   • CSearch the binary for the URL using strings.
   • DManually trace the decoding function and evaluate the Eval call step by step.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In VBA, what is the purpose of a 'Module'?

   • AA type of document that contains macros
   • BA security feature that restricts macro execution
   • CA container for VBA code that can hold procedures and declarations
   • DA built-in function that performs a specific calculation
   Reveal Solution Discussion Select an answer first
4. 38application · easy

   An analyst is examining a malicious .docm file and extracts the document metadata using oledump. The metadata shows the author as "John Doe" and the last saved by as "Jane Smith". The creation time is 2023-05-01 and the modification time is 2023-05-02. What can the analyst infer from this metadata?

   • AThe document is a coordinated attack by two known threat actors
   • BThe document was definitely created by John Doe and modified by Jane Smith
   • CThe document was created on May 1 and modified on May 2, so the macro was added on May 2
   • DThe document may have been edited by multiple users, but the names could be fake or spoofed
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the main purpose of dynamic analysis of a malicious macro?

   • ATo calculate the hash of the document
   • BTo observe the macro's runtime behavior, such as file system changes and network connections
   • CTo extract the macro source code without executing it
   • DTo identify the file format of the document
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What type of artifact might be embedded in an Office document to provide additional clues about its purpose?

   • AAn embedded OLE object
   • BA network packet capture
   • CA registry hive
   • DA memory dump
   Reveal Solution Discussion Select an answer first