During dynamic analysis of an obfuscated malware sample, which technique is used to capture the unpacked code after the malware has executed its unpacking routine?

Entropy calculation of the file

When analyzing a packed malware sample, which deobfuscation strategy involves allowing the malware to unpack itself and then analyzing the resulting code?

String extraction from the packed file

Static disassembly of the packed file

An analyst is triaging a suspicious executable. The PE file has a .data section with entropy of 7.9, but the .text section has entropy of 6.1. The import table is normal for a C++ application. What is the most likely explanation for the high entropy in .data?

The .data section is actually code that has been obfuscated with a junk instruction inserter

The .text section is packed and the .data section is normal

The file is a legitimate application with a large string table

The .data section contains an encrypted or compressed payload

During static analysis of a suspicious binary, an analyst runs a tool that calculates the entropy of each section. The .text section shows an entropy value of 7.9 (out of 8.0). What does this high entropy most likely indicate?

The section is packed or encrypted

The section contains standard compiler-generated code

The section contains plaintext strings

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 3)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
During dynamic analysis of an obfuscated malware sample, which technique is used to capture the unpacked code after the malware has executed its unpacking routine?
Select an answer first
12foundation · easy
When analyzing a packed malware sample, which deobfuscation strategy involves allowing the malware to unpack itself and then analyzing the resulting code?
Select an answer first
13foundation · easy
Which tool is specifically designed to remove compression or encryption from a packed executable, restoring the original code for analysis?
Select an answer first
14application · medium
An analyst is triaging a suspicious executable. The PE file has a .data section with entropy of 7.9, but the .text section has entropy of 6.1. The import table is normal for a C++ application. What is the most likely explanation for the high entropy in .data?
Select an answer first
15foundation · easy
During static analysis of a suspicious binary, an analyst runs a tool that calculates the entropy of each section. The .text section shows an entropy value of 7.9 (out of 8.0). What does this high entropy most likely indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.