A malware sample behaves differently when run in a VM versus physical hardware. You need to determine whether it is using anti-VM or anti-debugging techniques. Which indicator would most strongly suggest anti-VM rather than anti-debugging?

The sample checks the PEB BeingDebugged flag

The sample uses the RDTSC instruction to measure timing

The sample calls IsDebuggerPresent()

The sample queries the CPUID leaf 0x40000000 for a hypervisor vendor string

You are analyzing a malware sample that uses multiple anti-VM techniques: it checks for VMware tools, the MAC address, and the SMBIOS string. You are using a VMware VM. You need to bypass all these checks without breaking the sample's network functionality. Which approach is most effective?

Use a custom hypervisor that does not expose VMware-specific artifacts.

Disable the VM's network adapter to avoid MAC address checks.

Remove VMware Tools, change the MAC address to a non-VMware OUI, and edit the .vmx file to override SMBIOS strings.

Patch the sample's anti-VM checks in memory using a debugger.

You are statically analyzing a malware sample that uses string obfuscation to hide its API calls. The strings are constructed at runtime by XORing a key with a byte array. You need to extract the API names for analysis. Which approach is most effective?

Write a script to emulate the XOR operation on the byte arrays to recover the strings.

Use a debugger to break after the string is constructed and read the memory.

Use a hex editor to manually XOR the byte arrays.

Use a strings extraction tool that automatically decodes XOR-obfuscated strings.

A malware sample uses the `cpuid` instruction to check for the hypervisor bit. Which strategy is most effective for bypassing this anti-VM check?

Run the malware on physical hardware

Use a different virtual machine software

Disable the CPUID instruction in the VM settings

Modify the CPUID result to hide the hypervisor bit

Which static analysis technique is most useful for bypassing anti-disassembly tricks like opaque predicates?

Using a debugger to step over the opaque predicates

Using a disassembler that follows control flow to skip dead code

Using a hex editor to manually remove the opaque predicates

GIAC Reverse Engineering Malware

Domain 5Objective 3

Identifying and Bypassing Anti-Analysis Techniques GREM Practice Questions (Page 1)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 1–5

1application · medium
A malware sample behaves differently when run in a VM versus physical hardware. You need to determine whether it is using anti-VM or anti-debugging techniques. Which indicator would most strongly suggest anti-VM rather than anti-debugging?
Select an answer first
2expert · hard
You are analyzing a malware sample that uses multiple anti-VM techniques: it checks for VMware tools, the MAC address, and the SMBIOS string. You are using a VMware VM. You need to bypass all these checks without breaking the sample's network functionality. Which approach is most effective?
Select an answer first
3application · medium
You are statically analyzing a malware sample that uses string obfuscation to hide its API calls. The strings are constructed at runtime by XORing a key with a byte array. You need to extract the API names for analysis. Which approach is most effective?
Select an answer first
4foundation · easy
A malware sample uses the `cpuid` instruction to check for the hypervisor bit. Which strategy is most effective for bypassing this anti-VM check?
Select an answer first
5foundation · easy
Which static analysis technique is most useful for bypassing anti-disassembly tricks like opaque predicates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.