A security team needs to automate the analysis of a large number of PDF files for potential malware. They want to extract JavaScript actions, URLs, and embedded objects from each PDF and generate a report. Which tool or combination of tools is most appropriate for this task?

Use pdf-parser.py in a script that iterates through the PDFs and extracts JavaScript and URLs, then outputs a CSV report.

Use a single online PDF scanner that analyzes one file at a time.

Use a general-purpose antivirus scanner to scan the PDFs.

Use a hex editor to manually search for 'JavaScript' and 'http' in each file.

A PDF sample contains a heap spray pattern that fills memory with NOP sleds and shellcode. Which classification best describes this sample?

Exploit attempt targeting a PDF reader vulnerability

A malware analyst is examining a PDF that contains an embedded Flash object. The analyst notices that the PDF also contains a JavaScript action that calls util.printf() with a very long format string. Which vulnerability pattern is the analyst likely observing?

A cross-site scripting (XSS) attack via the embedded Flash object

A use-after-free vulnerability in the Flash player

A buffer overflow in the PDF viewer's JavaScript engine triggered by util.printf()

An integer overflow in the PDF parser when handling the Flash object

During analysis of a malicious PDF, an analyst extracts a JavaScript action that uses the following code: var payload = unescape('%u9090%u9090%u0c0c%u0c0c'); var nop = unescape('%u0c0c%u0c0c'); while (nop.length < 0x10000) nop += nop; var heap = nop.substring(0, 0x10000 - payload.length); var shellcode = heap + payload; this.print({bPrint: true, bUI: true, bFA: true, bQuiet: false}); The analyst needs to determine the purpose of this code. Which of the following best describes the behavior?

The code is attempting to download a remote payload using the print() function as a covert channel.

The code is creating a large array to cause a denial-of-service condition in the PDF viewer.

The code performs heap spraying by filling memory with a NOP sled and then triggers a vulnerability via the print() function.

The code is obfuscating a URL by encoding it with unescape() and then using print() to display it.

GIAC Reverse Engineering Malware

Domain 4Objective 2

Analyzing Malicious PDFs GREM Practice Questions (Page 7)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 31–35

31application · medium
A security team needs to automate the analysis of a large number of PDF files for potential malware. They want to extract JavaScript actions, URLs, and embedded objects from each PDF and generate a report. Which tool or combination of tools is most appropriate for this task?
Select an answer first
32application · medium
A PDF sample contains a heap spray pattern that fills memory with NOP sleds and shellcode. Which classification best describes this sample?
Select an answer first
33application · medium
A malware analyst is examining a PDF that contains an embedded Flash object. The analyst notices that the PDF also contains a JavaScript action that calls util.printf() with a very long format string. Which vulnerability pattern is the analyst likely observing?
Select an answer first
34foundation · easy
Which tool is a Python framework that provides a command-line interface for analyzing PDFs, including extracting objects and streams?
Select an answer first
35application · medium
During analysis of a malicious PDF, an analyst extracts a JavaScript action that uses the following code: var payload = unescape('%u9090%u9090%u0c0c%u0c0c'); var nop = unescape('%u0c0c%u0c0c'); while (nop.length < 0x10000) nop += nop; var heap = nop.substring(0, 0x10000 - payload.length); var shellcode = heap + payload; this.print({bPrint: true, bUI: true, bFA: true, bQuiet: false}); The analyst needs to determine the purpose of this code. Which of the following best describes the behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious PDFs GREM Practice Questions (Page 7)

Questions 31–35

A security team needs to automate the analysis of a large number of PDF files for potential malware. They want to extract JavaScript actions, URLs, and embedded objects from each PDF and generate a report. Which tool or combination of tools is most appropriate for this task?

A PDF sample contains a heap spray pattern that fills memory with NOP sleds and shellcode. Which classification best describes this sample?

A malware analyst is examining a PDF that contains an embedded Flash object. The analyst notices that the PDF also contains a JavaScript action that calls util.printf() with a very long format string. Which vulnerability pattern is the analyst likely observing?

Which tool is a Python framework that provides a command-line interface for analyzing PDFs, including extracting objects and streams?

Keep studying — Document and File Analysis