A malware sample is packed with a custom packer that unpacks only after checking for the presence of a specific VMware registry key. The analyst is using a VMware-based analysis VM. The sample detects the VM and exits without unpacking. What is the most effective way to obtain the unpacked payload?

Run the sample with a kernel debugger to hide the VM

Patch the VM detection routine in the debugger to skip the check

Modify the VMware registry keys to mimic a physical machine

Use a physical machine for analysis

While reviewing a malware sample, an analyst notices that the code contains many conditional jumps that always take the same path, and the function call graph is unusually deep with many small functions. What does this pattern most likely indicate?

The sample was written in a high-level language with heavy use of inline functions.

The sample uses control-flow flattening to obscure its logic.

The sample uses a virtual machine obfuscator to interpret bytecode.

The sample is a packed executable that has not been fully unpacked.

A malware sample uses a custom packer that employs a two-stage unpacking process. The first stage decrypts a second-stage loader, which then downloads an encrypted payload from a C2 server. The sample also checks for the presence of a debugger using the PEB BeingDebugged flag and the NtQueryInformationProcess API. The analyst has bypassed the anti-debugging checks and is now at the point where the second-stage loader is about to download the payload. The analyst needs to capture the decrypted payload. Which approach is most effective?

Use a network simulator to emulate the C2 server and provide a known encrypted payload, then dump memory after decryption.

Set a breakpoint on the InternetReadFile or recv API and dump the buffer after the download completes.

Patch the sample to skip the download and directly call the decryption routine with a hardcoded key.

Set a breakpoint after the decryption routine in the second-stage loader and dump the process memory.

An analyst is analyzing a packed sample that uses anti-debugging techniques, including IsDebuggerPresent and a timing check. The analyst needs to unpack the sample and observe its behavior, but the sample exits when a debugger is detected. The analyst has access to a debugger, a sandbox, and a scriptable unpacker. Which approach is most likely to succeed with the least effort?

Use the scriptable unpacker to statically unpack the sample

Use a combination of debugger and sandbox to bypass all anti-analysis

Run the sample in the sandbox and capture the unpacked payload from memory

Use the debugger to patch the anti-debugging checks and then unpack

An analyst is examining a suspicious executable and notices that the string 'http://malicious.example.com/update' is not visible in the file's plain strings, but the file contains a large blob of high-entropy data. The analyst suspects the URL is encrypted. What static analysis technique would best confirm this?

Disassemble the code and look for calls to URLDownloadToFile

Run the sample in a sandbox and monitor network traffic

Search for the URL in the file after XORing the entire file with common keys

Calculate the entropy of each section and compare to known packer signatures

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 2)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 6–10

6application · medium
A malware sample is packed with a custom packer that unpacks only after checking for the presence of a specific VMware registry key. The analyst is using a VMware-based analysis VM. The sample detects the VM and exits without unpacking. What is the most effective way to obtain the unpacked payload?
Select an answer first
7application · medium
While reviewing a malware sample, an analyst notices that the code contains many conditional jumps that always take the same path, and the function call graph is unusually deep with many small functions. What does this pattern most likely indicate?
Select an answer first
8expert · hard
A malware sample uses a custom packer that employs a two-stage unpacking process. The first stage decrypts a second-stage loader, which then downloads an encrypted payload from a C2 server. The sample also checks for the presence of a debugger using the PEB BeingDebugged flag and the NtQueryInformationProcess API. The analyst has bypassed the anti-debugging checks and is now at the point where the second-stage loader is about to download the payload. The analyst needs to capture the decrypted payload. Which approach is most effective?
Select an answer first
9expert · hard
An analyst is analyzing a packed sample that uses anti-debugging techniques, including IsDebuggerPresent and a timing check. The analyst needs to unpack the sample and observe its behavior, but the sample exits when a debugger is detected. The analyst has access to a debugger, a sandbox, and a scriptable unpacker. Which approach is most likely to succeed with the least effort?
Select an answer first
10application · medium
An analyst is examining a suspicious executable and notices that the string 'http://malicious.example.com/update' is not visible in the file's plain strings, but the file contains a large blob of high-entropy data. The analyst suspects the URL is encrypted. What static analysis technique would best confirm this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Obfuscated Malware GREM Practice Questions (Page 2)

Questions 6–10

A malware sample is packed with a custom packer that unpacks only after checking for the presence of a specific VMware registry key. The analyst is using a VMware-based analysis VM. The sample detects the VM and exits without unpacking. What is the most effective way to obtain the unpacked payload?

While reviewing a malware sample, an analyst notices that the code contains many conditional jumps that always take the same path, and the function call graph is unusually deep with many small functions. What does this pattern most likely indicate?

Keep studying — Malware Patterns and Obfuscation