A security team needs to create a YARA rule to detect a family of malicious RTF files. The family uses a common header, followed by a variable-length obfuscated blob, and then a fixed footer. The obfuscation method varies between samples, but the footer is always the same. The team wants to minimize false positives while detecting all samples. Which YARA rule design is most effective?

Match only the common header to catch all files in the family.

Match the entire file hash for each known sample.

Match the fixed footer and require a specific obfuscation pattern.

Match the common header and the fixed footer, with a wildcard for the variable-length obfuscated blob.

A malware analyst is examining an RTF document that contains an embedded OLE object with a macro. The analyst needs to determine the macro's behavior without executing the document on a production system. Which approach is most appropriate?

Extract the OLE object and use olevba.py to analyze the macro source code.

Open the RTF in Microsoft Word with macros enabled to observe the behavior.

Run the RTF through a generic antivirus scanner.

Use a hex editor to search for the string 'cmd.exe'.

What is a common obfuscation technique used in malicious RTF files?

Increasing the font size of the document.

Using hexadecimal encoding to hide the payload data.

Using standard English text to hide the payload.

Adding a digital signature to the document.

A security team is analyzing a malicious RTF document that uses obfuscation to hide its payload. The analyst notices that the RTF contains many control words like '\ul', '\b', and '\i' interspersed with hex-encoded data. The hex-encoded data appears to be a second RTF document. Which approach would best deobfuscate and extract the embedded RTF content?

Remove all control words from the file and then open it in a text editor.

Open the file in a word processor and manually copy the visible text.

Run the file through a YARA rule that matches common RTF exploit signatures.

Use a script to decode all hex sequences and then parse the resulting RTF with a standard RTF parser.

During analysis of a suspicious RTF file, an analyst identifies an '\object' control word followed by a large hex blob. The analyst wants to determine if the embedded object is a malicious executable or a benign document. Which tool would be most effective for this task?

Use a YARA rule to detect known RTF exploits.

Open the RTF in a sandbox and observe network traffic.

Use a text editor to search for 'MZ' in the hex blob.

Use oledump.py to extract the embedded OLE object and examine its streams.

GIAC Reverse Engineering Malware

Domain 4Objective 3

Analyzing Malicious RTF Files GREM Practice Questions (Page 3)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 11–15

11expert · hard
A security team needs to create a YARA rule to detect a family of malicious RTF files. The family uses a common header, followed by a variable-length obfuscated blob, and then a fixed footer. The obfuscation method varies between samples, but the footer is always the same. The team wants to minimize false positives while detecting all samples. Which YARA rule design is most effective?
Select an answer first
12application · medium
A malware analyst is examining an RTF document that contains an embedded OLE object with a macro. The analyst needs to determine the macro's behavior without executing the document on a production system. Which approach is most appropriate?
Select an answer first
13foundation · easy
What is a common obfuscation technique used in malicious RTF files?
Select an answer first
14application · medium
A security team is analyzing a malicious RTF document that uses obfuscation to hide its payload. The analyst notices that the RTF contains many control words like '\ul', '\b', and '\i' interspersed with hex-encoded data. The hex-encoded data appears to be a second RTF document. Which approach would best deobfuscate and extract the embedded RTF content?
Select an answer first
15application · medium
During analysis of a suspicious RTF file, an analyst identifies an '\object' control word followed by a large hex blob. The analyst wants to determine if the embedded object is a malicious executable or a benign document. Which tool would be most effective for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious RTF Files GREM Practice Questions (Page 3)

Questions 11–15

A malware analyst is examining an RTF document that contains an embedded OLE object with a macro. The analyst needs to determine the macro's behavior without executing the document on a production system. Which approach is most appropriate?

What is a common obfuscation technique used in malicious RTF files?

During analysis of a suspicious RTF file, an analyst identifies an '\object' control word followed by a large hex blob. The analyst wants to determine if the embedded object is a malicious executable or a benign document. Which tool would be most effective for this task?

Keep studying — Document and File Analysis