What is the purpose of a YARA rule in the context of RTF analysis?

To deobfuscate the RTF file's payload.

To convert the RTF file to a different format.

To execute the RTF file in a sandbox and observe its behavior.

To detect malicious RTF files based on static characteristics such as strings and metadata.

Why is it important to document the analysis process and findings for a malicious RTF file?

To support threat intelligence sharing and enable other analysts to reproduce the analysis.

To provide a user manual for the RTF file.

To increase the file's reputation score.

To fulfill legal requirements for copyright registration.

Which of the following is a common indicator of a malicious RTF file?

The document contains a large number of fonts.

The file size is less than 1 KB.

The presence of an embedded OLE object that is not visible in the document's normal view.

The RTF header uses the \rtf1 control word.

An incident response team is triaging a batch of RTF files suspected of exploiting a known vulnerability in Microsoft Word's RTF parser. The team wants to quickly identify files that contain the specific exploit pattern without opening them. Which method is most appropriate for this task?

Manually inspect the RTF control words in each file.

Run a YARA rule that matches the known exploit signature across the file batch.

Use a hex editor to search for the string 'exploit'.

Open each file in a sandbox and observe for crashes.

What is a common pattern to look for when detecting a CVE-2017-11882 exploit in an RTF file?

A large number of hyperlinks in the document.

An embedded OLE object that uses the Equation Editor 3.0 class.

An unusually high compression ratio in the RTF file.

The presence of a macro named 'AutoOpen'.

GIAC Reverse Engineering Malware

Domain 4Objective 3

Analyzing Malicious RTF Files GREM Practice Questions (Page 4)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
What is the purpose of a YARA rule in the context of RTF analysis?
Select an answer first
17foundation · easy
Why is it important to document the analysis process and findings for a malicious RTF file?
Select an answer first
18foundation · easy
Which of the following is a common indicator of a malicious RTF file?
Select an answer first
19application · medium
An incident response team is triaging a batch of RTF files suspected of exploiting a known vulnerability in Microsoft Word's RTF parser. The team wants to quickly identify files that contain the specific exploit pattern without opening them. Which method is most appropriate for this task?
Select an answer first
20foundation · easy
What is a common pattern to look for when detecting a CVE-2017-11882 exploit in an RTF file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.