Analyzing Malicious RTF Files GREM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is manually parsing a suspicious RTF file and encounters the following sequence: '{\rtf1\ansi\deff0 {\fonttbl {\f0 Times New Roman;}} \object\objemb\objdata ...}'. The analyst notices that the '\objdata' control word is followed by a large hex-encoded block. What does this structure indicate?

   • AThe RTF contains a macro that is encoded in the hex block.
   • BThe RTF is encrypted and the hex block is the encryption key.
   • CThe RTF is using a new font that is not recognized.
   • DThe RTF contains an embedded OLE object, and the hex block is the object's data.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A malware analyst is analyzing an RTF file that contains a macro with anti-sandbox techniques. The macro checks for the presence of specific processes and delays execution if it detects a sandbox. The analyst needs to observe the macro's full behavior. Which approach is most effective?

   • ARun the macro on a physical machine without any monitoring.
   • BOnly use static analysis to avoid triggering anti-sandbox techniques.
   • CUse a standard sandbox without modifications.
   • DUse a sandbox that can simulate or bypass anti-sandbox techniques, such as patching process lists or time acceleration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the first step in manually parsing an RTF file to look for embedded objects?

   • ACheck the file's hash against VirusTotal.
   • BSearch for the string '\object' in the raw text.
   • CRun the file in a debugger.
   • DConvert the file to PDF and inspect it.
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   An analyst is reviewing a batch of RTF files for potential malicious indicators. One file contains an unusually high number of '\objdata' control words and multiple '\object' groups. The analyst needs to prioritize this file for deeper analysis. Which indicator is the strongest justification for prioritization?

   • AThe file was created in the last 24 hours.
   • BThe file is smaller than 10 KB, suggesting it is a simple document.
   • CThe file contains multiple embedded OLE objects, which are commonly used to deliver exploits.
   • DThe file has a valid RTF header and opens correctly in a word processor.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is examining an RTF file that uses a custom obfuscation scheme: the file contains a series of '\bin' control words with binary data that, when XORed with a key derived from the file's creation time, produces a URL. The analyst needs to extract the URL and determine if it matches a known malicious domain. The analyst has limited time and must choose the most efficient method.

   • AWrite a Python script that parses the RTF, extracts '\bin' data, derives the key from the file's creation time, and decodes the URL.
   • BManually parse the RTF, extract the binary data, compute the XOR key from the file metadata, and decode the URL.
   • CRun the file in a sandbox and capture network traffic to observe the URL.
   • DUse a generic RTF parser to extract all strings and search for 'http'.
   Reveal Solution Discussion Select an answer first