A malware sample uses a multi-stage decoding process. The first stage decodes a second-stage payload using a simple XOR key. The second stage then decrypts the final payload using AES. The analyst has extracted both stages. What is the most efficient way to obtain the final payload?

Write a script that performs the XOR decode and then the AES decryption

Use a hex editor to manually XOR and then AES-decrypt

Search the sample for the AES key and use an online decryptor

Run the sample in a debugger and dump memory after the second stage

The Conficker worm used a custom packing algorithm to obfuscate its code. What was a key challenge this posed for analysts?

It used only simple XOR encoding

It used a well-known packer like UPX

Standard unpacking tools could not easily unpack it

A malware family uses a different encryption key for each sample, but the decryption routine is identical. The key is derived from the sample's file size. This technique is best described as which of the following?

Key-based encryption with a static decryptor

A known malware family uses a custom packer that decrypts its payload in memory and then jumps to the original entry point (OEP). The packer also uses a technique where the decryption key is derived from the first 4 bytes of the .text section. An analyst wants to unpack a new sample of this family. What is the most efficient approach?

Use a debugger to set a breakpoint on the jump to the OEP and dump the process memory

Run the sample in a sandbox and capture the network traffic

Re-implement the packer's decryption routine in a script

Use a static unpacker that supports this specific packer

During static analysis of a suspicious document, an analyst extracts a macro that contains a large array of integers. The macro also contains a loop that XORs each integer with 0x5A and writes the result to a file. What is the most likely purpose of this code?

It is decoding an embedded payload

It is generating a random key for encryption

It is obfuscating the macro's own code

It is performing a checksum calculation

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 1)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 1–5

1application · medium
A malware sample uses a multi-stage decoding process. The first stage decodes a second-stage payload using a simple XOR key. The second stage then decrypts the final payload using AES. The analyst has extracted both stages. What is the most efficient way to obtain the final payload?
Select an answer first
2foundation · easy
The Conficker worm used a custom packing algorithm to obfuscate its code. What was a key challenge this posed for analysts?
Select an answer first
3application · medium
A malware family uses a different encryption key for each sample, but the decryption routine is identical. The key is derived from the sample's file size. This technique is best described as which of the following?
Select an answer first
4application · medium
A known malware family uses a custom packer that decrypts its payload in memory and then jumps to the original entry point (OEP). The packer also uses a technique where the decryption key is derived from the first 4 bytes of the .text section. An analyst wants to unpack a new sample of this family. What is the most efficient approach?
Select an answer first
5application · medium
During static analysis of a suspicious document, an analyst extracts a macro that contains a large array of integers. The macro also contains a loop that XORs each integer with 0x5A and writes the result to a file. What is the most likely purpose of this code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.