Analyzing Malicious RTF Files GREM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst receives a suspicious RTF file from a phishing campaign. The file opens normally in a word processor, but the analyst notices the file size is unusually large for a text-only document. During a quick hex review, the analyst sees the string '\object' near the end of the file. Which next step would most efficiently confirm whether the file contains an embedded OLE object?

   • ASearch the raw bytes for the string 'AutoOpen' to check for a macro.
   • BChange the file extension to .zip and attempt to unzip it.
   • CRun the file through a tool like oledump.py to enumerate and extract any OLE streams.
   • DOpen the file in a hex editor and manually decode the entire RTF control word sequence.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is analyzing an RTF file that uses a non-standard obfuscation technique: the control words are encoded in Unicode, and the embedded object is split across multiple groups. The analyst needs to extract the embedded object. Which approach is most effective?

   • ARun the file through a sandbox to observe the exploit.
   • BSearch for the hex-encoded object data directly in the raw file.
   • CUse a standard RTF parser without modifications.
   • DDecode the Unicode-encoded control words first, then reassemble the split object groups before parsing.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is triaging an RTF file that contains a large number of control words and nested groups. The file is suspected of exploiting a known vulnerability in a word processor's font-parsing routine. The analyst needs to confirm the exploit pattern without executing the file. Which action is most appropriate?

   • AUse a hex editor to manually count the number of groups in the file.
   • BConvert the RTF to a plain-text file and search for the word 'exploit'.
   • COpen the file in a word processor with all security features disabled.
   • DCompare the control-word sequence against known exploit signatures using a YARA rule.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is investigating a targeted RTF attack. They have a YARA rule that detects a known CVE-2017-11882 exploit pattern. However, the rule is producing many false positives on benign documents that contain similar formatting. The team needs to reduce false positives while maintaining detection of the exploit. Which approach is most effective?

   • AAdd additional conditions to the YARA rule, such as requiring the presence of the specific Equation Editor object and the exploit payload string.
   • BUse a YARA rule that matches the file's magic bytes and size.
   • CBroaden the YARA rule to match any RTF file with the '\object' control word.
   • DRemove the YARA rule and rely on sandboxing all RTF files.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is examining a malicious RTF that uses multiple layers of obfuscation. The file contains hex-encoded data, then the decoded data is another RTF with an embedded OLE object. The analyst needs to extract the final payload. Which approach is most efficient?

   • AUse a YARA rule to detect the obfuscation pattern and then manually inspect the file.
   • BManually decode the hex using an online converter and then open the result in a text editor.
   • CRun the original RTF through a sandbox and capture the dropped payload.
   • DWrite a script that decodes the hex, parses the resulting RTF, and then extracts the OLE object using a tool like oledump.py.
   Reveal Solution Discussion Select an answer first