An analyst is comparing two .NET malware samples. Sample A has a large number of types and methods in its metadata, while Sample B has very few. Both samples have similar functionality. What is the most likely explanation for this difference?

Sample A is a .NET Framework assembly, while Sample B is a .NET Core assembly.

Sample A is packed, while Sample B is not packed.

Sample A is written in C#, while Sample B is written in VB.NET.

Sample A is not obfuscated, while Sample B is obfuscated with a tool that renames and removes unused metadata.

A .NET malware sample uses control-flow flattening and string encryption. The analyst has identified the string decryption routine and can invoke it statically. However, the control-flow flattening makes it difficult to understand the logic. What is the most efficient next step?

Manually trace the state machine in the decompiled code to reconstruct the original control flow.

Focus only on the decrypted strings and ignore the control flow, as the strings may reveal the malware's intent.

Run the sample in a debugger and record the execution path to understand the logic.

Use a deobfuscation tool like de4dot to reverse the control-flow flattening and then apply the string decryption script.

Which of the following is a common anti-VM technique that .NET malware might use?

Calling System.GC.Collect() to force garbage collection.

Encrypting all strings in the assembly.

Using System.Threading.Thread.Sleep to slow down analysis.

Checking for the presence of virtualization-related system files or drivers.

A .NET malware sample decompiles to code where all method names are single letters and string literals appear as byte arrays passed to a helper function. The control flow is a large switch statement with state variables. Which deobfuscation approach is most appropriate as the first step?

Write a script that calls the string-decryption helper for each byte array and replaces the literals in the decompiled output.

Run the sample in a sandbox and dump the decrypted strings from memory.

Use a control-flow-flattening deobfuscator plugin to restore the original switch structure.

Manually rename all methods to meaningful names based on their behavior observed in the decompiled code.

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 5)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 21–25

21application · medium
An analyst is comparing two .NET malware samples. Sample A has a large number of types and methods in its metadata, while Sample B has very few. Both samples have similar functionality. What is the most likely explanation for this difference?
Select an answer first
22expert · hard
A .NET malware sample uses control-flow flattening and string encryption. The analyst has identified the string decryption routine and can invoke it statically. However, the control-flow flattening makes it difficult to understand the logic. What is the most efficient next step?
Select an answer first
23foundation · easy
Which of the following is a common anti-VM technique that .NET malware might use?
Select an answer first
24application · medium
A .NET malware sample decompiles to code where all method names are single letters and string literals appear as byte arrays passed to a helper function. The control flow is a large switch statement with state variables. Which deobfuscation approach is most appropriate as the first step?
Select an answer first
25foundation · easy
In .NET metadata tables, which table is used to enumerate all the types defined in the assembly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.