A malware sample uses a multi-layer packing scheme. After unpacking the first layer, you find another packed section that needs to be unpacked. You are using a debugger to analyze the sample. What is the most efficient way to handle multiple layers of packing?

Set a breakpoint on the OEP of the first layer, dump the process, and then analyze the dumped file for the next layer.

Use a static unpacker that can handle multiple layers automatically.

Run the sample in a sandbox and capture the final unpacked code from memory.

Use a script to automatically break at each OEP and dump the memory at each stage.

You are configuring a dynamic analysis environment to analyze a malware sample that is known to check for the presence of VMware tools and the MAC address of the virtual NIC. You want the sample to run without detecting the VM. Which configuration change is most appropriate?

Patch the sample's anti-VM checks in memory using a debugger.

Remove VMware Tools from the guest OS and change the MAC address to a non-VMware OUI.

Disable the VM's network adapter entirely.

Use a custom hypervisor that does not expose VMware-specific artifacts.

An analyst is debugging a malware sample that calls `IsDebuggerPresent()` early in its execution. Which approach is most effective for bypassing this specific anti-debugging check without altering the malware's code?

Run the malware in a virtual machine

Set a breakpoint on the `IsDebuggerPresent` function and manually change the return value

Patch the `IsDebuggerPresent` function to always return 0

Use a stealth debugger that hides the debugger presence from the API

What is an opaque predicate in the context of anti-disassembly?

A method to encrypt the malware's code

A way to detect virtual machines using CPUID

A conditional branch that always evaluates to a known value

A technique to hide the entry point of the malware

During static analysis of a malware sample, you find that the code is heavily obfuscated with junk instructions inserted between real instructions. The disassembler shows many invalid opcodes because the junk bytes are not aligned with the instruction stream. What is the best approach to recover the real code?

Run the sample in a debugger and step through the code to identify the real instructions.

Manually patch the junk bytes to NOPs in the binary file.

Use a recursive traversal disassembler that follows control flow and skips unreachable junk bytes.

Use a linear disassembly pass that starts from the entry point and disassembles every byte sequentially.

GIAC Reverse Engineering Malware

Domain 5Objective 3

Identifying and Bypassing Anti-Analysis Techniques GREM Practice Questions (Page 4)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 16–20

16application · medium
A malware sample uses a multi-layer packing scheme. After unpacking the first layer, you find another packed section that needs to be unpacked. You are using a debugger to analyze the sample. What is the most efficient way to handle multiple layers of packing?
Select an answer first
17application · medium
You are configuring a dynamic analysis environment to analyze a malware sample that is known to check for the presence of VMware tools and the MAC address of the virtual NIC. You want the sample to run without detecting the VM. Which configuration change is most appropriate?
Select an answer first
18foundation · easy
An analyst is debugging a malware sample that calls `IsDebuggerPresent()` early in its execution. Which approach is most effective for bypassing this specific anti-debugging check without altering the malware's code?
Select an answer first
19foundation · easy
What is an opaque predicate in the context of anti-disassembly?
Select an answer first
20application · medium
During static analysis of a malware sample, you find that the code is heavily obfuscated with junk instructions inserted between real instructions. The disassembler shows many invalid opcodes because the junk bytes are not aligned with the instruction stream. What is the best approach to recover the real code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.