A user receives a file with a .doc extension, but it is actually a ZIP archive containing XML files and a macro. Which file format is this?

A legacy Word 97-2003 document with macros

A Word 2007+ document with macros (.docm) that has been renamed to .doc

A Word template with macros (.dotm)

A macro-free Word document (.docx)

An analyst is analyzing a macro that uses a long Sleep() call before executing the payload. The macro also checks the system uptime and exits if uptime is less than 10 minutes. What is the most likely purpose of these combined techniques?

To avoid detection by antivirus that scans on system startup

To evade sandboxes that have short execution timeouts or that simulate a fresh boot

To reduce the chance of the macro being interrupted by a user

To ensure the system is fully booted before running the payload

During static analysis of a malicious Word document, an analyst finds VBA code that uses the Evaluate() function with a string built from concatenated substrings. The substrings are stored in reverse order in the code. What is the primary purpose of this technique?

To ensure compatibility with older versions of Microsoft Office

To improve the performance of the macro

To hide the actual code or command from static analysis tools

To bypass macro security settings by using a different execution engine

A malicious macro uses a multi-stage payload delivery: it first writes a file to disk, then uses 'Shell' to execute it, and finally deletes the file. An analyst wants to capture the file before it is deleted. What is the best approach?

Use a network sniffer to capture the file being downloaded.

Use a file system monitoring tool to capture the file as soon as it is written.

Run the macro in a debugger and pause at the Shell call.

Modify the macro to remove the deletion step and then run it.

What is the purpose of a macro checking for the presence of a debugger?

To detect if it is being analyzed and evade analysis

To ensure the macro runs only on specific Office versions

To improve the performance of the macro

To log the macro's execution for debugging purposes

GIAC Reverse Engineering Malware

Domain 4Objective 1

Analyzing Malicious Office Macros GREM Practice Questions (Page 9)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

11concepts

Questions 41–45

41application · medium
A user receives a file with a .doc extension, but it is actually a ZIP archive containing XML files and a macro. Which file format is this?
Select an answer first
42expert · hard
An analyst is analyzing a macro that uses a long Sleep() call before executing the payload. The macro also checks the system uptime and exits if uptime is less than 10 minutes. What is the most likely purpose of these combined techniques?
Select an answer first
43application · medium
During static analysis of a malicious Word document, an analyst finds VBA code that uses the Evaluate() function with a string built from concatenated substrings. The substrings are stored in reverse order in the code. What is the primary purpose of this technique?
Select an answer first
44expert · hard
A malicious macro uses a multi-stage payload delivery: it first writes a file to disk, then uses 'Shell' to execute it, and finally deletes the file. An analyst wants to capture the file before it is deleted. What is the best approach?
Select an answer first
45foundation · easy
What is the purpose of a macro checking for the presence of a debugger?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.