An analyst is examining a PDF that has a valid header and trailer but the cross-reference table appears to be incomplete. The analyst suspects that the PDF may be using incremental updates to hide malicious objects. Which technique should the analyst use to ensure all objects are discovered?

Use a PDF parser that rebuilds the object tree from the trailer and follows all object references, ignoring the cross-reference table.

Manually search the file for 'obj' and 'endobj' keywords to find all objects.

Open the PDF in a viewer and navigate through the pages to see if any malicious content appears.

Use a hex editor to look for the 'startxref' keyword and manually locate the cross-reference table.

A PDF sample contains an object with a /Launch action that points to an embedded executable file. Which classification best describes this behavior?

Legitimate PDF feature that cannot be abused

Exploit attempt targeting a PDF reader vulnerability

Social engineering technique that relies on user interaction

Obfuscation method to hide the executable from antivirus

A security analyst is investigating a PDF that was delivered to a user via email. The PDF contains a JavaScript action that uses the Collab.collectEmailInfo() function, which is known to be associated with a specific vulnerability. The analyst also notices that the PDF uses a heap spray technique. The analyst needs to determine the likely exploit and the best way to confirm it. Which approach is most appropriate?

Search the web for 'Collab.collectEmailInfo' to identify the CVE and then read the public exploit details.

Use a static analysis tool to extract the JavaScript and manually identify the vulnerability pattern.

Submit the PDF to an online sandbox service and review the report.

Use a sandboxed PDF viewer with a debugger to trigger the vulnerability and observe the shellcode execution.

A PDF sample is detected by one antivirus engine but not by others. The analyst wants to determine if the PDF is truly malicious or a false positive. Which approach is most effective?

Delete the PDF because it is likely malicious

Submit the PDF to more antivirus engines and rely on the majority vote

Perform a detailed static analysis of the PDF structure and JavaScript to identify malicious indicators

Run the PDF in a sandbox and observe if it downloads additional files

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 6)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 26–30

26foundation · easy
Which command-line tool can be used to extract embedded files from a PDF for further analysis?
Select an answer first
27application · medium
An analyst is examining a PDF that has a valid header and trailer but the cross-reference table appears to be incomplete. The analyst suspects that the PDF may be using incremental updates to hide malicious objects. Which technique should the analyst use to ensure all objects are discovered?
Select an answer first
28application · medium
A PDF sample contains an object with a /Launch action that points to an embedded executable file. Which classification best describes this behavior?
Select an answer first
29expert · hard
A security analyst is investigating a PDF that was delivered to a user via email. The PDF contains a JavaScript action that uses the Collab.collectEmailInfo() function, which is known to be associated with a specific vulnerability. The analyst also notices that the PDF uses a heap spray technique. The analyst needs to determine the likely exploit and the best way to confirm it. Which approach is most appropriate?
Select an answer first
30expert · hard
A PDF sample is detected by one antivirus engine but not by others. The analyst wants to determine if the PDF is truly malicious or a false positive. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious PDFs GREM Practice Questions (Page 6)

Questions 26–30

Which command-line tool can be used to extract embedded files from a PDF for further analysis?

An analyst is examining a PDF that has a valid header and trailer but the cross-reference table appears to be incomplete. The analyst suspects that the PDF may be using incremental updates to hide malicious objects. Which technique should the analyst use to ensure all objects are discovered?

A PDF sample contains an object with a /Launch action that points to an embedded executable file. Which classification best describes this behavior?

A PDF sample is detected by one antivirus engine but not by others. The analyst wants to determine if the PDF is truly malicious or a false positive. Which approach is most effective?

Keep studying — Document and File Analysis