Analyzing Malicious RTF Files GREM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the correct general structure of an RTF file?

   • AA header line with the RTF version, followed by the raw text without any grouping.
   • BA binary header followed by a series of control words and groups.
   • CA sequence of independent groups, each starting with \rtf, that are concatenated.
   • DA single group that starts with \rtf and contains the document header and body.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of deobfuscating an RTF file?

   • ATo convert the RTF file to a different format.
   • BTo reduce the file size of the RTF document.
   • CTo reveal the underlying malicious code or payload hidden by obfuscation techniques.
   • DTo make the document easier to read for end users.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   An analyst has completed the analysis of a malicious RTF file and needs to document the findings. The analysis included extracting an embedded OLE object and running it in a sandbox. The analyst must ensure the report is useful for future incident response. Which element is most important to include?

   • AThe version of the word processor used to open the file.
   • BThe name of the analyst who performed the analysis.
   • CThe exact file hash and the date and time of the analysis.
   • DThe color of the icon used in the sandbox environment.
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   An analyst has completed a full analysis of a malicious RTF file, including macro extraction and sandbox execution. The analyst must now write a report for both technical and non-technical stakeholders. Which report structure best serves this audience?

   • AList the indicators of compromise first, followed by the raw sandbox logs.
   • BStart with an executive summary, then provide technical details, indicators of compromise, and recommended actions.
   • CWrite a single paragraph describing the file as malicious, without technical details.
   • DProvide only the technical details, including macro code and sandbox logs, without an executive summary.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is an OLE object in the context of an RTF file?

   • AA hyperlink that points to an external resource.
   • BA text string that contains the document's metadata.
   • CA font definition that is used throughout the document.
   • DA binary data block that is embedded using the \object control word.
   Reveal Solution Discussion Select an answer first