In a .NET assembly, where is the entry point that the CLR uses to begin execution?

The first method in the metadata

The constructor of the first class

Which .NET API is often used by malware to create a scheduled task for persistence?

Microsoft.Win32.TaskScheduler.TaskService

System.Net.WebClient.DownloadString

System.Diagnostics.Process.Start

While analyzing a .NET malware sample, an analyst notices a method that checks the value of Environment.Is64BitOperatingSystem and then calls Assembly.Load() with a byte array. The method is called only if the check returns true. What is the most likely purpose of this conditional logic?

It is a decoy to mislead analysts into thinking the malware is architecture-aware.

It is an anti-analysis technique that only runs the payload on 64-bit systems to evade 32-bit sandboxes.

It checks for a 64-bit environment to decide whether to use a specific obfuscation routine.

It loads a 64-bit specific payload to avoid compatibility issues on 64-bit systems.

A .NET malware sample uses the following code: if (System.Diagnostics.Debugger.IsAttached) Environment.Exit(0);. The analyst is using dnSpy to debug the sample. What is the most effective way to bypass this check?

Set a breakpoint on the Environment.Exit call and manually skip it when hit.

Run the sample without a debugger and use a process monitor to observe its behavior.

Use a debugger that hides its presence from the IsDebuggerPresent API.

Patch the IL code to change the branch instruction so it does not exit when a debugger is attached.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 1)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 1–5

1foundation · easy
In a .NET assembly, where is the entry point that the CLR uses to begin execution?
Select an answer first
2foundation · easy
Which .NET API is often used by malware to create a scheduled task for persistence?
Select an answer first
3application · medium
While analyzing a .NET malware sample, an analyst notices a method that checks the value of Environment.Is64BitOperatingSystem and then calls Assembly.Load() with a byte array. The method is called only if the check returns true. What is the most likely purpose of this conditional logic?
Select an answer first
4foundation · easy
In a .NET assembly, which part contains the actual executable instructions that are compiled to native code at runtime by the CLR?
Select an answer first
5expert · hard
A .NET malware sample uses the following code: if (System.Diagnostics.Debugger.IsAttached) Environment.Exit(0);. The analyst is using dnSpy to debug the sample. What is the most effective way to bypass this check?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.