A malware analyst wants to automate the extraction of JavaScript from a large batch of PDF files. Which approach is most suitable?

Use a debugger to step through each PDF

Use a network sniffer to capture PDF downloads

Write a Python script using the peepdf library to parse each PDF and extract JavaScript objects

Manually open each PDF in a text editor and search for 'JavaScript'

While analyzing a malicious PDF, an analyst notices that the JavaScript code uses hexadecimal escapes and string concatenation to build function names. What is the primary purpose of this technique?

To evade signature-based detection by hiding suspicious strings

To reduce the file size of the PDF

To make the code compatible with older PDF readers

To improve the performance of the JavaScript execution

Which vulnerability class is commonly exploited by malicious PDFs that use malformed font files?

Denial of service via large page count

Cross-site scripting in annotations

Buffer overflow in font parsing

A security team is analyzing a PDF that was found on a compromised system. The PDF has a valid header and trailer, but the cross-reference table is incomplete. The team suspects that the PDF may be using incremental updates to hide malicious objects. They also notice that the PDF contains a JavaScript action that uses a known exploit. The team needs to determine the full extent of the malicious content. Which approach is most appropriate?

Use a PDF parser that rebuilds the object tree from the trailer, then extract and analyze all JavaScript actions and embedded files.

Use a hex editor to manually search for 'obj' and 'endobj' keywords and extract all objects.

Open the PDF in a sandboxed viewer and observe the behavior.

Use a network sniffer to capture any traffic generated when the PDF is opened.

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 3)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 11–15

11application · medium
A malware analyst wants to automate the extraction of JavaScript from a large batch of PDF files. Which approach is most suitable?
Select an answer first
12application · medium
While analyzing a malicious PDF, an analyst notices that the JavaScript code uses hexadecimal escapes and string concatenation to build function names. What is the primary purpose of this technique?
Select an answer first
13foundation · easy
Which vulnerability class is commonly exploited by malicious PDFs that use malformed font files?
Select an answer first
14foundation · easy
In a PDF file, which structure is the first line of the file and indicates the version of the PDF specification being used?
Select an answer first
15expert · hard
A security team is analyzing a PDF that was found on a compromised system. The PDF has a valid header and trailer, but the cross-reference table is incomplete. The team suspects that the PDF may be using incremental updates to hide malicious objects. They also notice that the PDF contains a JavaScript action that uses a known exploit. The team needs to determine the full extent of the malicious content. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious PDFs GREM Practice Questions (Page 3)

Questions 11–15

A malware analyst wants to automate the extraction of JavaScript from a large batch of PDF files. Which approach is most suitable?

While analyzing a malicious PDF, an analyst notices that the JavaScript code uses hexadecimal escapes and string concatenation to build function names. What is the primary purpose of this technique?

Which vulnerability class is commonly exploited by malicious PDFs that use malformed font files?

In a PDF file, which structure is the first line of the file and indicates the version of the PDF specification being used?

Keep studying — Document and File Analysis