Which of the following is a common indicator of obfuscation in a PE file?

A large number of imported DLLs

A section named .data with low entropy

A section named .text with high entropy

An analyst is analyzing a sample that uses a custom packer. The unpacking stub is small and appears to use a simple XOR loop to decrypt the payload. The analyst wants to extract the decrypted payload for further analysis. Which tool or technique is most appropriate?

Use a disassembler to statically analyze the XOR loop and manually decrypt the payload.

Use a debugger to set a breakpoint after the XOR loop and dump the process memory.

Use a generic unpacker that automatically detects and unpacks the sample.

Use a memory forensics tool to analyze the sample's memory dump after it has run.

An analyst is analyzing a sample that decrypts its payload in memory only after receiving a specific command from a command-and-control (C2) server. The analyst has network simulation tools but cannot let the sample connect to the real C2. What is the most effective approach to observe the decrypted payload?

Run the sample in a sandbox with internet access to allow it to connect to the real C2 server.

Use a network simulator to emulate the C2 server and send the expected command, then dump the process memory.

Set a breakpoint on the decryption function and manually modify the registers to simulate the C2 response.

Patch the sample to skip the C2 communication and directly call the decryption function with a hardcoded key.

A malware analyst needs to observe the behavior of an obfuscated sample that unpacks itself at runtime. Which approach is most appropriate?

Disassemble the raw binary with a disassembler

Execute the sample in a controlled sandbox and monitor its actions

An analyst receives a suspicious Windows executable. Static analysis shows a .text section with unusually high entropy and a .rsrc section containing what appears to be a second executable. The import table shows only LoadLibraryA and GetProcAddress. The analyst needs to determine whether the file is packed and identify the packer. Which approach is most appropriate?

Search the file for the string 'UPX' to confirm the packer

Use a PE analysis tool to examine section entropy, section names, and the import table, then compare against known packer signatures

Disassemble the entry point and trace all calls to LoadLibraryA to identify the payload

Run the executable in a sandbox and capture the unpacked image from memory

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 7)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which of the following is a common indicator of obfuscation in a PE file?
Select an answer first
32application · medium
An analyst is analyzing a sample that uses a custom packer. The unpacking stub is small and appears to use a simple XOR loop to decrypt the payload. The analyst wants to extract the decrypted payload for further analysis. Which tool or technique is most appropriate?
Select an answer first
33application · medium
An analyst is analyzing a sample that decrypts its payload in memory only after receiving a specific command from a command-and-control (C2) server. The analyst has network simulation tools but cannot let the sample connect to the real C2. What is the most effective approach to observe the decrypted payload?
Select an answer first
34foundation · easy
A malware analyst needs to observe the behavior of an obfuscated sample that unpacks itself at runtime. Which approach is most appropriate?
Select an answer first
35application · medium
An analyst receives a suspicious Windows executable. Static analysis shows a .text section with unusually high entropy and a .rsrc section containing what appears to be a second executable. The import table shows only LoadLibraryA and GetProcAddress. The analyst needs to determine whether the file is packed and identify the packer. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Obfuscated Malware GREM Practice Questions (Page 7)

Questions 31–35

Which of the following is a common indicator of obfuscation in a PE file?

An analyst is analyzing a sample that uses a custom packer. The unpacking stub is small and appears to use a simple XOR loop to decrypt the payload. The analyst wants to extract the decrypted payload for further analysis. Which tool or technique is most appropriate?

A malware analyst needs to observe the behavior of an obfuscated sample that unpacks itself at runtime. Which approach is most appropriate?

Keep studying — Malware Patterns and Obfuscation