An analyst is analyzing a PDF that uses multiple obfuscation techniques. The PDF contains a JavaScript action that uses the eval() function with a string that has been encoded using multiple layers of hexadecimal and Unicode escapes. Additionally, the PDF uses a technique where the same object is defined multiple times with different content, and the viewer uses the last definition. Which tool or approach would be most effective to deobfuscate and analyze the JavaScript?

Use a JavaScript debugger in a sandboxed environment to step through the eval() calls and observe the final decoded strings.

Use a text editor to manually decode the hexadecimal and Unicode escapes layer by layer.

Use a PDF parser to list all objects and compare the duplicate definitions.

Use a regex to extract all strings and look for URLs or suspicious keywords.

What is the primary purpose of using multiple cross-reference tables in a malicious PDF?

To confuse analysis tools that expect a single cross-reference table

An analyst extracts JavaScript from a PDF and sees the following code: var a = '/Ap'.concat('p'); var b = a + 'end'; eval(b + 'Data'); What is the purpose of this code?

To reduce the file size of the PDF

To improve performance of the JavaScript

To dynamically construct a function name to evade static detection

To make the code compatible with older PDF readers

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 1)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 1–5

1foundation · easy
Which PDF feature is often abused in exploits to trigger a use-after-free vulnerability?
Select an answer first
2foundation · easy
Which tool is specifically designed to extract and analyze JavaScript code embedded in PDF files?
Select an answer first
3application · medium
An analyst is analyzing a PDF that uses multiple obfuscation techniques. The PDF contains a JavaScript action that uses the eval() function with a string that has been encoded using multiple layers of hexadecimal and Unicode escapes. Additionally, the PDF uses a technique where the same object is defined multiple times with different content, and the viewer uses the last definition. Which tool or approach would be most effective to deobfuscate and analyze the JavaScript?
Select an answer first
4foundation · easy
What is the primary purpose of using multiple cross-reference tables in a malicious PDF?
Select an answer first
5application · medium
An analyst extracts JavaScript from a PDF and sees the following code: var a = '/Ap'.concat('p'); var b = a + 'end'; eval(b + 'Data'); What is the purpose of this code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious PDFs GREM Practice Questions (Page 1)

Questions 1–5

Which PDF feature is often abused in exploits to trigger a use-after-free vulnerability?

Which tool is specifically designed to extract and analyze JavaScript code embedded in PDF files?

What is the primary purpose of using multiple cross-reference tables in a malicious PDF?

An analyst extracts JavaScript from a PDF and sees the following code: var a = '/Ap'.concat('p'); var b = a + 'end'; eval(b + 'Data'); What is the purpose of this code?

Keep studying — Document and File Analysis