An analyst is examining a .NET malware sample that has been obfuscated with a tool that merges multiple assemblies into a single assembly. The analyst notices that the metadata tables contain types from different namespaces that are not typically found together. What is the most likely explanation?

The malware is using dynamic code generation to create new types at runtime.

The obfuscator merged multiple assemblies into one, combining their metadata tables.

The malware is using reflection to load types from external assemblies.

The malware is packed, and the packer has corrupted the metadata tables.

When using ILSpy to analyze a .NET malware sample, what is the primary output you expect to see?

A list of imported Windows API functions

Intermediate Language (IL) opcodes only

Readable C# or VB.NET source code

A .NET malware sample is protected by a custom packer that loads the original assembly from an encrypted resource at runtime. The analyst has identified the resource and the decryption routine. The analyst wants to extract the original assembly for static analysis. Which approach is most reliable?

Use a hex editor to manually extract the encrypted resource and decrypt it.

Write a script that decrypts the resource using the identified routine and saves the result as a new .NET assembly.

Run the malware in a sandbox and dump the process memory after the unpacking routine has executed.

Use a generic unpacker like UPX to unpack the executable.

Which approach is commonly used to deobfuscate .NET malware that uses string encryption?

Renaming all methods to meaningful names

Compiling the assembly to native code

Running the malware in a debugger and dumping decrypted strings from memory

GIAC Reverse Engineering Malware

Domain 5Objective 1

Examining .NET Malware GREM Practice Questions (Page 6)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 26–30

26expert · hard
An analyst is examining a .NET malware sample that has been obfuscated with a tool that merges multiple assemblies into a single assembly. The analyst notices that the metadata tables contain types from different namespaces that are not typically found together. What is the most likely explanation?
Select an answer first
27foundation · easy
When using ILSpy to analyze a .NET malware sample, what is the primary output you expect to see?
Select an answer first
28expert · hard
A .NET malware sample is protected by a custom packer that loads the original assembly from an encrypted resource at runtime. The analyst has identified the resource and the decryption routine. The analyst wants to extract the original assembly for static analysis. Which approach is most reliable?
Select an answer first
29foundation · easy
Which approach is commonly used to deobfuscate .NET malware that uses string encryption?
Select an answer first
30foundation · easy
Which .NET metadata table would you inspect to identify the external assemblies that a .NET malware sample references?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.