An incident response team has analyzed a malicious RTF file that used a known exploit to drop a payload. The team needs to document the findings for a threat intelligence sharing platform. Which information is most important to include to enable other organizations to detect and mitigate the threat?

The exact time the file was received by the team.

The color scheme and fonts used in the RTF document.

The name of the analyst who performed the analysis.

The YARA rule used to detect the RTF, the embedded object's hash, and the exploit's CVE identifier.

What is the primary purpose of using a sandbox to analyze a malicious RTF file?

To speed up the analysis process by running the file on a high-performance machine.

To observe the file's behavior in an isolated environment without risking the host system.

To convert the RTF file into a safe PDF.

To automatically delete the malicious file after analysis.

What is a key element to include in a report documenting the analysis of a malicious RTF file?

The file's SHA-256 hash and a summary of the observed malicious behavior.

The file's author's name and email address.

The file's color scheme and font choices.

GIAC Reverse Engineering Malware

Domain 4Objective 3

Analyzing Malicious RTF Files GREM Practice Questions (Page 9)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
Which YARA condition would match an RTF file that contains the string '\object'?
Select an answer first
42expert · hard
An incident response team has analyzed a malicious RTF file that used a known exploit to drop a payload. The team needs to document the findings for a threat intelligence sharing platform. Which information is most important to include to enable other organizations to detect and mitigate the threat?
Select an answer first
43foundation · easy
Which tool is commonly used to extract embedded objects from an RTF file?
Select an answer first
44foundation · easy
What is the primary purpose of using a sandbox to analyze a malicious RTF file?
Select an answer first
45foundation · easy
What is a key element to include in a report documenting the analysis of a malicious RTF file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious RTF Files GREM Practice Questions (Page 9)

Questions 41–45

Which YARA condition would match an RTF file that contains the string '\object'?

Which tool is commonly used to extract embedded objects from an RTF file?

What is the primary purpose of using a sandbox to analyze a malicious RTF file?

What is a key element to include in a report documenting the analysis of a malicious RTF file?

Keep studying — Document and File Analysis