An analyst has a .NET malware sample that appears to be a simple dropper. The analyst loads it in dnSpy and sees only a Main() method that calls a single method named 'Execute' in the same class. However, the 'Execute' method body shows only 'return;'. The analyst suspects the real logic is elsewhere. Which initial step is most appropriate to locate the actual malicious code?

Look at the assembly's manifest to identify the entry point and then set a breakpoint on it in a debugger.

Immediately run the sample in a sandbox and capture network traffic to see what the dropper downloads.

Use a hex editor to search for ASCII strings that might reveal the malicious payload or command-and-control URL.

Inspect the assembly metadata tables for all type and method definitions, then check each method body for non-trivial IL instructions.

An analyst is analyzing a .NET malware sample that uses reflection to dynamically invoke methods. The method names are stored as encrypted strings and are decrypted at runtime. The analyst wants to identify the methods being invoked without executing the sample. What is the most effective approach?

Use a decompiler to view the IL code and manually trace the reflection calls.

Use a script to invoke the string decryption routine for each encrypted string, then search the decompiled code for reflection calls that use those strings.

Use a metadata inspection tool to list all methods in the assembly and guess which ones are invoked.

Run the sample in a debugger and set breakpoints on the Invoke method to capture the method names at runtime.

An analyst is tracing the execution flow of a .NET malware sample. The entry point is a small method that calls another method, which then calls a third method. The analyst wants to understand the overall behavior without stepping through every instruction. What is the most efficient approach?

Use a disassembler to view the IL code of each method and manually trace the calls.

Set breakpoints on every method in the call chain and run the sample in a debugger.

Use a process monitor to observe the malware's actions at runtime and infer the call flow.

Use dnSpy to decompile the assembly and read the high-level source code of each method in the call chain.

An analyst is examining a .NET malware sample that uses reflection to invoke methods by name. The analyst needs to identify the exact method names and their calling sequence without executing the sample. Which approach will most efficiently reveal this information?

Load the assembly in ILSpy and export the metadata tables to a CSV file for review.

Use a hex editor to search for method name strings in the raw binary and manually map them to the call sequence.

Open the assembly in dnSpy, locate the entry point, and trace the IL instructions that construct the MethodInfo objects and call Invoke().

Run the sample in a debugger and set breakpoints on every call to Invoke() to capture the method names at runtime.

During malware analysis, which observation indicates that a binary is unmanaged native code rather than managed .NET code?

The binary contains a .NET metadata directory in its PE header.

The binary's entry point is in a section named .text and it imports kernel32.dll.

The binary imports functions from mscoree.dll.

The binary contains a #Strings stream.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 4)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 16–20

16application · medium
An analyst has a .NET malware sample that appears to be a simple dropper. The analyst loads it in dnSpy and sees only a Main() method that calls a single method named 'Execute' in the same class. However, the 'Execute' method body shows only 'return;'. The analyst suspects the real logic is elsewhere. Which initial step is most appropriate to locate the actual malicious code?
Select an answer first
17expert · hard
An analyst is analyzing a .NET malware sample that uses reflection to dynamically invoke methods. The method names are stored as encrypted strings and are decrypted at runtime. The analyst wants to identify the methods being invoked without executing the sample. What is the most effective approach?
Select an answer first
18application · medium
An analyst is tracing the execution flow of a .NET malware sample. The entry point is a small method that calls another method, which then calls a third method. The analyst wants to understand the overall behavior without stepping through every instruction. What is the most efficient approach?
Select an answer first
19application · medium
An analyst is examining a .NET malware sample that uses reflection to invoke methods by name. The analyst needs to identify the exact method names and their calling sequence without executing the sample. Which approach will most efficiently reveal this information?
Select an answer first
20foundation · easy
During malware analysis, which observation indicates that a binary is unmanaged native code rather than managed .NET code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.