An analyst is analyzing a sample that uses a custom packer with anti-unpacking techniques. The sample checks for the presence of a debugger and also checks for breakpoints by scanning its own code for 0xCC bytes. The analyst has bypassed the anti-debugging checks but the sample still detects the breakpoints and terminates. What is the most effective way to bypass the breakpoint detection?

Patch the breakpoint detection routine in the sample's code to always return a 'no breakpoints' result.

Use a debugger plugin that hides the breakpoints from the sample.

Run the sample without a debugger and use a memory dump tool to capture the payload.

Use hardware breakpoints instead of software breakpoints, as they do not modify the code.

An analyst is analyzing a sample that uses a multi-threaded anti-debugging technique. One thread continuously checks for the presence of a debugger, and if detected, it terminates the process. The main thread performs the unpacking. The analyst has attached a debugger and is trying to dump the unpacked payload. The sample detects the debugger and terminates before the unpacking completes. Which approach is most effective?

Patch the anti-debugging check in the anti-debugging thread to always return a 'not debugged' result.

Suspend the anti-debugging thread before it can terminate the process, then continue debugging the main thread.

Use a debugger plugin that hides the debugger from all threads.

Run the sample without a debugger and use a memory dump tool to capture the payload.

A known malware family uses a custom packer that encrypts the payload with a rolling XOR key. The key is 4 bytes long and is incremented by 1 after each byte. An analyst has a sample and wants to unpack it. The analyst has access to a debugger and a Python environment. Which approach is most efficient?

Use a debugger to break at the OEP and dump memory

Write a Python script that implements the rolling XOR decryption

Run the sample in a sandbox and capture the payload from memory

Use a universal unpacker that supports the packer

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 6)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 26–30

26expert · hard
An analyst is analyzing a sample that uses a custom packer with anti-unpacking techniques. The sample checks for the presence of a debugger and also checks for breakpoints by scanning its own code for 0xCC bytes. The analyst has bypassed the anti-debugging checks but the sample still detects the breakpoints and terminates. What is the most effective way to bypass the breakpoint detection?
Select an answer first
27expert · hard
An analyst is analyzing a sample that uses a multi-threaded anti-debugging technique. One thread continuously checks for the presence of a debugger, and if detected, it terminates the process. The main thread performs the unpacking. The analyst has attached a debugger and is trying to dump the unpacked payload. The sample detects the debugger and terminates before the unpacking completes. Which approach is most effective?
Select an answer first
28foundation · easy
A malware analyst encounters a binary where the original executable code has been compressed and replaced with a small stub that decompresses the original code in memory before executing it. Which obfuscation technique does this describe?
Select an answer first
29expert · hard
A known malware family uses a custom packer that encrypts the payload with a rolling XOR key. The key is 4 bytes long and is incremented by 1 after each byte. An analyst has a sample and wants to unpack it. The analyst has access to a debugger and a Python environment. Which approach is most efficient?
Select an answer first
30foundation · easy
Which API call pattern is commonly seen in obfuscated malware that dynamically resolves API addresses at runtime?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Obfuscated Malware GREM Practice Questions (Page 6)

Questions 26–30

A malware analyst encounters a binary where the original executable code has been compressed and replaced with a small stub that decompresses the original code in memory before executing it. Which obfuscation technique does this describe?

Which API call pattern is commonly seen in obfuscated malware that dynamically resolves API addresses at runtime?

Keep studying — Malware Patterns and Obfuscation