A PDF sample contains both a heap spray and a use-after-free exploit pattern. The analyst needs to determine the exact vulnerability being targeted. What is the most reliable method?

Run the PDF in a sandbox and observe which process crashes

Search the PDF for the string 'CVE'

Use a debugger to step through the JavaScript and identify the memory addresses used

Compare the exploit code with known exploit signatures from public databases

During dynamic analysis of a malicious PDF, the analyst wants to capture the JavaScript code that is generated at runtime before it is executed. Which approach is most effective?

Use a network sniffer to capture the PDF's network traffic

Use a JavaScript debugger to set a breakpoint on eval() and inspect the argument

Use a PDF static analyzer to list all objects

Use a hex editor to manually decode the PDF streams

An analyst extracts JavaScript from a malicious PDF and sees a long string of hexadecimal characters that is decoded using a custom algorithm before being passed to eval(). Which tool or technique would be most effective for understanding the final payload?

Run the extracted JavaScript in a debugger with breakpoints on eval() to capture the decoded string

Search the PDF for the string 'eval' and assume the payload is the hex string

Use a hex editor to manually decode the hexadecimal string

Use a PDF static analyzer to list all objects and hope the payload is in plaintext

An analyst is analyzing a PDF that uses object streams (ObjStm) to store multiple objects. What is a common reason a malicious PDF would use this structure?

To compress objects and evade simple static analysis tools

To make the PDF compatible with older readers

To improve rendering speed in PDF readers

To reduce the file size for email delivery

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 2)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 6–10

6expert · hard
A PDF sample contains both a heap spray and a use-after-free exploit pattern. The analyst needs to determine the exact vulnerability being targeted. What is the most reliable method?
Select an answer first
7application · medium
During dynamic analysis of a malicious PDF, the analyst wants to capture the JavaScript code that is generated at runtime before it is executed. Which approach is most effective?
Select an answer first
8application · medium
An analyst extracts JavaScript from a malicious PDF and sees a long string of hexadecimal characters that is decoded using a custom algorithm before being passed to eval(). Which tool or technique would be most effective for understanding the final payload?
Select an answer first
9foundation · easy
Which tool is commonly used for dynamic analysis of a PDF file to observe its behavior in a controlled environment?
Select an answer first
10application · medium
An analyst is analyzing a PDF that uses object streams (ObjStm) to store multiple objects. What is a common reason a malicious PDF would use this structure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.