Analyzing Malicious RTF Files GREM Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is investigating a series of RTF files that exploit a known vulnerability in a word processor. The team has a YARA rule that matches the exploit pattern, but it is producing false positives on legitimate files. The team needs to refine the rule to reduce false positives without missing true positives. Which approach is most effective?

   • AAdd a condition that requires the presence of a specific OLE object class identifier (CLSID) associated with the vulnerability.
   • BUse a broader pattern that matches any RTF file with a large number of control words.
   • CRemove the YARA rule and rely on manual analysis of all RTF files.
   • DChange the rule to match only the RTF header and the exploit string.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A malicious RTF file contains an embedded OLE object that is itself an RTF file. The inner RTF contains a macro. An analyst needs to extract the inner RTF and analyze the macro. Which tool or method is most effective for this nested extraction?

   • AOpen the outer RTF in a word processor and copy the embedded object to a new document.
   • BRun the outer RTF through a generic sandbox and hope the macro executes.
   • CUse a hex editor to manually locate the inner RTF header and copy the bytes to a new file.
   • DUse rtfdump to recursively extract embedded objects and then run olevba on the extracted inner RTF.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A malware analyst is analyzing an RTF with an embedded macro that appears to download a second-stage payload. The macro is heavily obfuscated and uses API calls that are not visible in static analysis. The analyst needs to determine the full behavior of the macro. Which approach is most effective?

   • AUse a debugger to step through the macro code in a live environment.
   • BUse a combination of static analysis with olevba.py and dynamic analysis in a sandbox with network monitoring.
   • COnly use dynamic analysis in a sandbox without static analysis.
   • DOnly use static analysis with olevba.py to avoid executing the macro.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What tool can be used to extract macros from an RTF file?

   • Aobjdump
   • Bolevba
   • Ctcpdump
   • Dnmap
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During an incident response, an analyst finds an RTF file that contains an embedded OLE object. The object appears to be a Microsoft Equation Editor component, which is known to be associated with CVE-2017-11882. The analyst needs to confirm the exploit and determine the payload's behavior. Which sequence of actions provides the most reliable confirmation?

   • AUse a YARA rule for CVE-2017-11882 to scan the file, then delete the file if the rule matches.
   • BOpen the RTF in a word processor and enable macros to see if any scripts execute.
   • CSearch the raw RTF for the string 'Equation.3' and assume it is malicious based on the presence of that string.
   • DExtract the OLE object with oletools, then run the extracted binary in a sandbox to observe network connections.
   Reveal Solution Discussion Select an answer first