A malware sample uses several misdirection techniques: it inserts junk instructions that do not affect the program state, uses opaque predicates to create fake branches, and obfuscates function names. You need to quickly identify the core malicious functionality. What is the most efficient first step?

Run a dynamic analysis in a controlled environment and focus on the API calls and network traffic.

Use a debugger to step through every instruction in the binary.

Search for the original function names in the binary's import table.

Manually remove all junk instructions and opaque predicates from the entire binary.

You are analyzing a ransomware sample that uses both opaque predicates and control flow flattening. You have limited time and need to extract the encryption routine. What is the most efficient deobfuscation strategy?

Use symbolic execution to identify the encryption routine and trace its data flow.

Run the ransomware in a sandbox and observe the files it modifies.

Search for cryptographic constants in the binary.

Manually trace the flattened control flow to find the encryption routine.

You are analyzing a malware sample that uses control flow flattening. The original program logic is hidden by replacing structured control flow with a dispatcher that uses a state variable to jump between basic blocks. What is the most effective strategy to recover the original logic?

Use a decompiler that automatically flattens the control flow.

Trace the state variable and reconstruct the original control flow graph by mapping state transitions.

Disassemble the binary and manually read each basic block in address order.

Run the binary in a sandbox and record the system calls to infer the logic.

When dealing with control flow flattening, which strategy is most effective for recovering the original program logic?

Search for all 'mov' instructions and remove them

Delete the dispatcher function from the binary

Trace the execution path and record the sequence of state values to reconstruct the original control flow

Use a decompiler that automatically removes all state variables

You are analyzing a malware sample that uses opaque predicates and control flow flattening. You have a symbolic execution tool that can handle both, but it requires significant computational resources and time. You have a deadline. What is the best way to prioritize your analysis?

Use a debugger instead of symbolic execution to trace the entire binary.

Skip the analysis and rely on the malware's strings for indicators.

Run symbolic execution on the entire binary and wait for it to finish.

Focus symbolic execution on the functions that handle sensitive data (e.g., encryption keys, C2 addresses).

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 2)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 6–10

6application · medium
A malware sample uses several misdirection techniques: it inserts junk instructions that do not affect the program state, uses opaque predicates to create fake branches, and obfuscates function names. You need to quickly identify the core malicious functionality. What is the most efficient first step?
Select an answer first
7application · medium
You are analyzing a ransomware sample that uses both opaque predicates and control flow flattening. You have limited time and need to extract the encryption routine. What is the most efficient deobfuscation strategy?
Select an answer first
8application · medium
You are analyzing a malware sample that uses control flow flattening. The original program logic is hidden by replacing structured control flow with a dispatcher that uses a state variable to jump between basic blocks. What is the most effective strategy to recover the original logic?
Select an answer first
9foundation · easy
When dealing with control flow flattening, which strategy is most effective for recovering the original program logic?
Select an answer first
10expert · hard
You are analyzing a malware sample that uses opaque predicates and control flow flattening. You have a symbolic execution tool that can handle both, but it requires significant computational resources and time. You have a deadline. What is the best way to prioritize your analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.