Which technique is commonly used by malicious PDFs to hide JavaScript code from static scanners?

Encoding the JavaScript stream with ASCIIHexDecode

Increasing the PDF version number

A malware analyst needs to analyze a PDF that uses multiple evasion techniques, including object streams, malformed xref, and JavaScript obfuscation. The analyst has limited time and needs to quickly determine if the PDF is malicious. Which tool or approach is most efficient?

Use a network sniffer to capture any outbound connections

Use a PDF analysis framework like peepdf with automated deobfuscation and object extraction

Use a hex editor to manually search for suspicious strings

Run the PDF in a sandbox and wait for the report

An analyst is examining a PDF that contains an embedded file attachment. The attachment is a PDF file that itself contains JavaScript. The analyst wants to determine if the embedded PDF is malicious. Which technique is most appropriate?

Open the embedded PDF in a viewer to see if it displays any suspicious content.

Use a network sniffer to capture any traffic generated when the parent PDF is opened.

Search the parent PDF for the string 'JavaScript' to see if the embedded PDF contains it.

Extract the embedded PDF and run the same static and dynamic analysis tools on it as a standalone file.

A PDF sample contains an embedded Flash object that is triggered by an action. What is the most important reason to analyze this Flash object?

Flash objects are always malicious

The Flash object may contain exploit code targeting Flash vulnerabilities

Flash objects are used to compress PDF content

Flash objects are used to improve PDF rendering

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 5)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 21–25

21foundation · easy
Which technique is commonly used by malicious PDFs to hide JavaScript code from static scanners?
Select an answer first
22foundation · easy
Which component of a PDF file is used by a PDF reader to locate the offset of each indirect object within the file?
Select an answer first
23expert · hard
A malware analyst needs to analyze a PDF that uses multiple evasion techniques, including object streams, malformed xref, and JavaScript obfuscation. The analyst has limited time and needs to quickly determine if the PDF is malicious. Which tool or approach is most efficient?
Select an answer first
24application · medium
An analyst is examining a PDF that contains an embedded file attachment. The attachment is a PDF file that itself contains JavaScript. The analyst wants to determine if the embedded PDF is malicious. Which technique is most appropriate?
Select an answer first
25application · medium
A PDF sample contains an embedded Flash object that is triggered by an action. What is the most important reason to analyze this Flash object?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.