A .NET malware sample is loaded in ILSpy. The analyst sees the assembly manifest, which lists the assembly name, version, and referenced assemblies. The analyst also sees the IL code for each method. Which component of the .NET assembly is the analyst directly viewing?

The resources and embedded files

The garbage collection heap and type system

The native header and import table

An analyst has a .NET malware sample that is packed. The unpacking stub is unmanaged code that loads the CLR and runs the managed payload. The analyst wants to extract the managed payload for static analysis. Which approach is most reliable?

Use a .NET unpacker tool that can statically unpack the sample without execution.

Use a debugger to step through the unpacking stub and capture the payload when it is loaded into memory.

Analyze the unmanaged stub with a native disassembler to understand the unpacking algorithm and reverse it manually.

Run the sample in a sandbox and dump the managed assembly from memory after the unpacking stub has executed.

An analyst is examining a .NET malware sample that uses string encryption. The strings are decrypted by a method that takes an encrypted byte array and a key as parameters. The analyst has identified the decryption method and wants to recover the plaintext strings without executing the malware. Which approach is most efficient?

Write a small script or program that calls the decryption method with the encrypted byte arrays and keys extracted from the assembly.

Search the assembly for the plaintext strings using a hex editor.

Use a .NET decompiler to automatically decrypt all strings in the assembly.

Use a debugger to set a breakpoint on the decryption method and read the decrypted strings from memory during execution.

What is the role of the Common Language Runtime (CLR) in executing .NET malware?

It provides a managed execution environment with services like JIT compilation and garbage collection.

It translates IL code directly to machine code before the program starts.

It prevents malware from calling any Windows API functions.

It only executes code that has been digitally signed.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 2)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 6–10

6application · medium
A .NET malware sample is loaded in ILSpy. The analyst sees the assembly manifest, which lists the assembly name, version, and referenced assemblies. The analyst also sees the IL code for each method. Which component of the .NET assembly is the analyst directly viewing?
Select an answer first
7expert · hard
An analyst has a .NET malware sample that is packed. The unpacking stub is unmanaged code that loads the CLR and runs the managed payload. The analyst wants to extract the managed payload for static analysis. Which approach is most reliable?
Select an answer first
8application · medium
An analyst is examining a .NET malware sample that uses string encryption. The strings are decrypted by a method that takes an encrypted byte array and a key as parameters. The analyst has identified the decryption method and wants to recover the plaintext strings without executing the malware. Which approach is most efficient?
Select an answer first
9foundation · easy
What is the role of the Common Language Runtime (CLR) in executing .NET malware?
Select an answer first
10foundation · easy
When analyzing a .NET malware sample, you notice that all method names have been changed to meaningless identifiers like 'a', 'b', and 'c'. Which obfuscation technique is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Examining .NET Malware GREM Practice Questions (Page 2)

Questions 6–10

A .NET malware sample is loaded in ILSpy. The analyst sees the assembly manifest, which lists the assembly name, version, and referenced assemblies. The analyst also sees the IL code for each method. Which component of the .NET assembly is the analyst directly viewing?

An analyst has a .NET malware sample that is packed. The unpacking stub is unmanaged code that loads the CLR and runs the managed payload. The analyst wants to extract the managed payload for static analysis. Which approach is most reliable?

What is the role of the Common Language Runtime (CLR) in executing .NET malware?

When analyzing a .NET malware sample, you notice that all method names have been changed to meaningless identifiers like 'a', 'b', and 'c'. Which obfuscation technique is being used?

Keep studying — Advanced Malware Analysis