A security team is analyzing a .NET malware sample. In dnSpy, the code shows methods named 'a()', 'b()', and 'c()' with no meaningful names. The strings in the assembly appear as arrays of bytes that are decoded at runtime. The control flow in each method is a large switch statement with many cases. Which obfuscation techniques are being used?

Base64 encoding, anti-VM, and metadata stripping

Packing, anti-debugging, and resource encryption

Renaming, string encryption, and control flow flattening

Native code injection, API hooking, and process hollowing

A malware analyst receives a .NET executable that fails to decompile properly in dnSpy. The PE header shows a suspicious section name, and the entry point is in a native stub that loads the CLR. The analyst suspects the sample is packed. Which tool or technique is most appropriate to unpack the .NET executable for further analysis?

Run the sample in a sandbox and dump the process memory after the unpacking routine has executed.

Use a hex editor to manually remove the packer stub and extract the original assembly.

Use a .NET unpacker like de4dot to unpack the assembly and restore the original metadata and IL code.

Use a native unpacker like UPX to unpack the executable.

An analyst needs to dynamically analyze a .NET malware sample that is suspected of using anti-sandbox techniques. The analyst has a Windows 10 VM with network isolation and process monitoring tools installed. Which additional step is most important to increase the likelihood of observing the malware's malicious behavior?

Configure the VM to mimic a real user environment by adding common applications, user activity, and hardware devices.

Disable the VM's network adapter to prevent the malware from communicating with its command-and-control server.

Patch the anti-sandbox checks in the malware using a debugger before executing it.

Use a tool like Process Monitor to capture file system, registry, and process activity.

A .NET malware sample uses P/Invoke to call CreateRemoteThread from kernel32.dll. The analyst opens the sample in dnSpy and sees the DllImport attribute. What does this indicate about the malware's execution?

The malware is packed and the DllImport is part of the unpacking stub.

The malware is mixing managed code with unmanaged native API calls to perform low-level operations.

The malware is using the .NET runtime to execute native code without any managed components.

The malware is entirely unmanaged code that has been wrapped in a .NET assembly.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 11)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 51–55

51application · medium
A security team is analyzing a .NET malware sample. In dnSpy, the code shows methods named 'a()', 'b()', and 'c()' with no meaningful names. The strings in the assembly appear as arrays of bytes that are decoded at runtime. The control flow in each method is a large switch statement with many cases. Which obfuscation techniques are being used?
Select an answer first
52application · medium
A malware analyst receives a .NET executable that fails to decompile properly in dnSpy. The PE header shows a suspicious section name, and the entry point is in a native stub that loads the CLR. The analyst suspects the sample is packed. Which tool or technique is most appropriate to unpack the .NET executable for further analysis?
Select an answer first
53application · medium
An analyst needs to dynamically analyze a .NET malware sample that is suspected of using anti-sandbox techniques. The analyst has a Windows 10 VM with network isolation and process monitoring tools installed. Which additional step is most important to increase the likelihood of observing the malware's malicious behavior?
Select an answer first
54application · medium
A .NET malware sample uses P/Invoke to call CreateRemoteThread from kernel32.dll. The analyst opens the sample in dnSpy and sees the DllImport attribute. What does this indicate about the malware's execution?
Select an answer first
55application · medium
While analyzing a .NET malware sample in dnSpy, an analyst notices a method that checks the system's MAC address and compares it against a list of known virtual machine vendor prefixes. If a match is found, the method calls 'Environment.Exit(0)'. What anti-analysis technique is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Examining .NET Malware GREM Practice Questions (Page 11)

Questions 51–55

A .NET malware sample uses P/Invoke to call CreateRemoteThread from kernel32.dll. The analyst opens the sample in dnSpy and sees the DllImport attribute. What does this indicate about the malware's execution?

While analyzing a .NET malware sample in dnSpy, an analyst notices a method that checks the system's MAC address and compares it against a list of known virtual machine vendor prefixes. If a match is found, the method calls 'Environment.Exit(0)'. What anti-analysis technique is this?

Keep studying — Advanced Malware Analysis