You have a packed malware sample that uses a custom packer. When you run it in a sandbox, it unpacks itself in memory and then executes. You need to capture the unpacked code for static analysis. Which approach is most effective?

Use a debugger to set a breakpoint on the original entry point (OEP) after the unpacking stub finishes.

Use a static unpacker that automatically detects the packer and unpacks the file.

Run the sample in a sandbox and capture the network traffic only.

Use a memory forensics tool to dump the entire VM memory after the sample runs.

Which dynamic analysis tool feature is specifically designed to help bypass anti-debugging techniques?

Stealth mode that hides the debugger from the target process

During static analysis of a malware sample, an analyst notices that the code contains many conditional branches that always evaluate to the same result, such as `if (1+1 == 2) { ... }`. Which anti-analysis technique is the malware most likely using?

Import address table obfuscation

You are configuring a dynamic analysis environment to analyze a malware sample that uses both anti-VM and anti-debugging techniques. The sample checks for VMware tools, the presence of a debugger, and also uses timing checks. You need to run the sample in a VM with a debugger attached to capture its behavior. Which configuration is most effective?

Run the sample without a debugger and use API monitoring.

Use a VM with VMware Tools removed, a debugger plugin like ScyllaHide, and hardware breakpoints to minimize timing overhead.

Use a custom hypervisor and a stealth debugger.

Patch the sample's anti-VM and anti-debugging checks in memory.

While analyzing a malware binary in Ghidra, you notice that the decompiler shows a function with many conditional branches that all lead to the same code. The branches appear to be opaque predicates designed to confuse analysis. What is the best way to simplify the function for analysis?

Use Ghidra's 'Remove unreachable code' feature to eliminate the dead branches.

Use a symbolic execution engine to automatically resolve the predicates.

Manually patch each opaque predicate to always take the real path.

Ignore the opaque predicates and focus on the main execution path.

GIAC Reverse Engineering Malware

Domain 5Objective 3

Identifying and Bypassing Anti-Analysis Techniques GREM Practice Questions (Page 3)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 11–15

11application · medium
You have a packed malware sample that uses a custom packer. When you run it in a sandbox, it unpacks itself in memory and then executes. You need to capture the unpacked code for static analysis. Which approach is most effective?
Select an answer first
12foundation · easy
Which dynamic analysis tool feature is specifically designed to help bypass anti-debugging techniques?
Select an answer first
13foundation · easy
During static analysis of a malware sample, an analyst notices that the code contains many conditional branches that always evaluate to the same result, such as `if (1+1 == 2) { ... }`. Which anti-analysis technique is the malware most likely using?
Select an answer first
14expert · hard
You are configuring a dynamic analysis environment to analyze a malware sample that uses both anti-VM and anti-debugging techniques. The sample checks for VMware tools, the presence of a debugger, and also uses timing checks. You need to run the sample in a VM with a debugger attached to capture its behavior. Which configuration is most effective?
Select an answer first
15application · medium
While analyzing a malware binary in Ghidra, you notice that the decompiler shows a function with many conditional branches that all lead to the same code. The branches appear to be opaque predicates designed to confuse analysis. What is the best way to simplify the function for analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.