An analyst is examining a .NET malware sample and notices that the assembly manifest lists a reference to an assembly named 'ConfuserEx'. What does this indicate?

The malware is packed with a custom packer named ConfuserEx.

The malware was compiled with a specific version of the .NET framework.

The malware was obfuscated using the ConfuserEx obfuscator.

The malware uses a library called ConfuserEx for its malicious functionality.

What is a common first step in deobfuscating a .NET malware sample that uses control flow flattening?

Rename all methods to random names

Delete the metadata tables to simplify the assembly

Identify the dispatcher and state variables in the decompiled code

Run the malware on a physical machine without any monitoring

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 12)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 56–57

56application · medium
An analyst is examining a .NET malware sample and notices that the assembly manifest lists a reference to an assembly named 'ConfuserEx'. What does this indicate?
Select an answer first
57foundation · easy
What is a common first step in deobfuscating a .NET malware sample that uses control flow flattening?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Examining .NET Malware GREM Practice Questions (Page 12)

Questions 56–57

An analyst is examining a .NET malware sample and notices that the assembly manifest lists a reference to an assembly named 'ConfuserEx'. What does this indicate?

What is a common first step in deobfuscating a .NET malware sample that uses control flow flattening?

Keep studying — Advanced Malware Analysis