Analyzing Malicious RTF Files GREM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A malware analyst is using a custom script to parse RTF files and extract embedded objects. The script currently only extracts objects that are directly after the '\object' control word. However, the analyst finds that some malicious RTF files use nested groups to hide the object. What should the analyst do to improve the script?

   • AModify the script to recursively parse RTF groups and handle nested '\object' control words.
   • BIncrease the script's buffer size to read larger files.
   • CRun the script on a different operating system.
   • DUse a regex pattern that matches any '\object' regardless of context.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is investigating an RTF file that contains an embedded macro. The macro is obfuscated using string concatenation and variable renaming. The analyst needs to determine the macro's intent and document the findings for a threat-intelligence report. Which tool and method combination provides the most complete analysis?

   • AUse a hex editor to search for the string 'AutoOpen' and assume the macro is malicious.
   • BOpen the RTF in Microsoft Word and enable macros to observe the behavior directly.
   • CUse olevba to extract and deobfuscate the macro, then manually trace the key function calls.
   • DRun the file through a generic sandbox and record the system changes.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the first step in analyzing an embedded OLE object extracted from an RTF file?

   • AConvert the OLE object to a PDF.
   • BRun the OLE object directly on the host machine.
   • CIdentify the type of the OLE object (e.g., Equation Editor, Word document, executable).
   • DDelete the OLE object from the RTF file.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center receives an RTF file that is suspected of containing a macro that downloads a payload. The analyst needs to observe the macro's behavior in a controlled environment. Which approach is most appropriate?

   • AUse a hex editor to manually decode the macro.
   • BExecute the RTF in a sandboxed virtual machine with network monitoring and process logging.
   • COpen the RTF on an analyst's workstation with macros enabled.
   • DSubmit the file to an online multi-scanner.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the RTF file format, what is the purpose of a control word?

   • AIt defines the document's character set and encoding.
   • BIt is a keyword that begins with a backslash and is used to represent formatting instructions or special characters.
   • CIt is a delimiter that separates the document header from the body text.
   • DIt is a marker that indicates the end of an embedded object.
   Reveal Solution Discussion Select an answer first