While analyzing a packed sample in a debugger, the analyst notices that the program calls IsDebuggerPresent early in the entry point and then jumps to a different code path if the return value is non-zero. The analyst wants to bypass this check to continue analysis. What is the most appropriate action?

Remove the IsDebuggerPresent import from the import table

Patch the jump instruction to force the non-debugger path

Run the sample without a debugger and rely on dynamic analysis

Change the PE header to mark the file as a kernel-mode driver

A malware sample uses a simple XOR loop to decode a string that is later passed to URLDownloadToFile. The analyst has identified the XOR key by comparing the encoded data with a known plaintext fragment. What is the most efficient way to decode the full string?

Use a hex editor to manually XOR each byte with the key

Re-implement the XOR loop in a Python script and run it against the encoded data

Run the sample in a debugger and single-step through the loop to observe the decoded string

Set a breakpoint on URLDownloadToFile and read the string from the stack at runtime

A malware sample is packed with a known packer. The analyst wants to unpack it statically without executing the sample. Which tool is most appropriate for this task?

A network sniffer to capture the unpacked payload

A universal unpacker that supports the specific packer

A debugger to single-step through the unpacking stub

A hex editor to manually remove the packer stub

An analyst is analyzing a sample that uses multiple anti-analysis techniques: it checks for a debugger via the PEB BeingDebugged flag, checks for VMware via a registry key, and uses a timing check on a decryption loop. The analyst is using a debugger on a VMware VM. The sample exits before unpacking. The analyst wants to bypass all checks with minimal modifications. What is the most efficient strategy?

Use a kernel debugger to hide the debugger and VM

Patch all conditional jumps that lead to the exit path

Run the sample without a debugger in the VM and rely on dynamic analysis

Patch the PEB BeingDebugged flag to 0 and modify the VMware registry key, then set a breakpoint after the timing check

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 4)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16application · medium
While analyzing a packed sample in a debugger, the analyst notices that the program calls IsDebuggerPresent early in the entry point and then jumps to a different code path if the return value is non-zero. The analyst wants to bypass this check to continue analysis. What is the most appropriate action?
Select an answer first
17application · medium
A malware sample uses a simple XOR loop to decode a string that is later passed to URLDownloadToFile. The analyst has identified the XOR key by comparing the encoded data with a known plaintext fragment. What is the most efficient way to decode the full string?
Select an answer first
18foundation · easy
Which obfuscation technique is characterized by malware that changes its code signature each time it replicates, often using a mutation engine, while the underlying functionality remains the same?
Select an answer first
19application · medium
A malware sample is packed with a known packer. The analyst wants to unpack it statically without executing the sample. Which tool is most appropriate for this task?
Select an answer first
20expert · hard
An analyst is analyzing a sample that uses multiple anti-analysis techniques: it checks for a debugger via the PEB BeingDebugged flag, checks for VMware via a registry key, and uses a timing check on a decryption loop. The analyst is using a debugger on a VMware VM. The sample exits before unpacking. The analyst wants to bypass all checks with minimal modifications. What is the most efficient strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Obfuscated Malware GREM Practice Questions (Page 4)

Questions 16–20

A malware sample uses a simple XOR loop to decode a string that is later passed to URLDownloadToFile. The analyst has identified the XOR key by comparing the encoded data with a known plaintext fragment. What is the most efficient way to decode the full string?

Which obfuscation technique is characterized by malware that changes its code signature each time it replicates, often using a mutation engine, while the underlying functionality remains the same?

A malware sample is packed with a known packer. The analyst wants to unpack it statically without executing the sample. Which tool is most appropriate for this task?

Keep studying — Malware Patterns and Obfuscation