You are analyzing a malware sample that uses a mix of junk instructions and opaque predicates. You have a limited time and need to determine if the malware contains a specific malicious behavior (e.g., keylogging). What is the most efficient approach?

Manually remove all junk instructions and opaque predicates, then search for keylogging APIs.

Use dynamic analysis to observe the API calls and see if any keylogging-related APIs are called.

Use a decompiler to decompile the binary and search for keylogging strings.

Search for known keylogging malware signatures in the binary.

You are analyzing a malware binary that uses junk instructions such as `nop`, `lea eax, [eax+0]`, and `mov edi, edi` to pad the code. You want to reduce the noise in the disassembly to focus on the real logic. Which approach is most efficient?

Use a debugger to step through the code and only record instructions that modify registers or memory.

Use a disassembler plugin that automatically detects and hides common junk instruction patterns.

Use a strings utility to extract all printable strings and correlate them with the junk instructions.

Manually scroll through the disassembly and ignore the junk instructions.

You are analyzing a malware sample that uses both control flow flattening and opaque predicates. The sample also contains a large amount of dead code. You have limited time and need to produce a high-level understanding of the malware's capabilities. Which approach balances speed and accuracy best?

Run the malware in a sandbox and rely on the behavioral report to infer capabilities.

Use a decompiler with symbolic execution and de-flattening plugins to automatically simplify the code.

Use a strings utility to extract all strings and guess the malware's behavior.

Manually trace through the flattened dispatcher with a debugger to understand the control flow.

A malware sample uses control flow flattening to obscure its logic. You have identified the dispatcher and the state variable. To recover the original control flow, you decide to use a tool that can reconstruct the control flow graph. Which tool feature is most important for this task?

The ability to perform symbolic execution and track the state variable.

The ability to export the disassembly to a text file.

The ability to display the disassembly in color-coded basic blocks.

The ability to run the malware in a sandbox and record API calls.

You are analyzing a malware sample that uses junk instructions and opaque predicates. You have a limited-time engagement and need to produce a report on the malware's capabilities. You have access to both a debugger and a binary analysis framework with scripting. Which approach is most efficient?

Manually remove junk instructions and opaque predicates using a hex editor.

Run the malware in a sandbox and rely solely on dynamic analysis.

Write a script to automatically remove junk instructions and patch opaque predicates, then analyze the cleaned binary.

Use the debugger to step through the entire binary and manually note the behavior.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 3)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 11–15

11expert · hard
You are analyzing a malware sample that uses a mix of junk instructions and opaque predicates. You have a limited time and need to determine if the malware contains a specific malicious behavior (e.g., keylogging). What is the most efficient approach?
Select an answer first
12application · medium
You are analyzing a malware binary that uses junk instructions such as `nop`, `lea eax, [eax+0]`, and `mov edi, edi` to pad the code. You want to reduce the noise in the disassembly to focus on the real logic. Which approach is most efficient?
Select an answer first
13expert · hard
You are analyzing a malware sample that uses both control flow flattening and opaque predicates. The sample also contains a large amount of dead code. You have limited time and need to produce a high-level understanding of the malware's capabilities. Which approach balances speed and accuracy best?
Select an answer first
14application · hard
A malware sample uses control flow flattening to obscure its logic. You have identified the dispatcher and the state variable. To recover the original control flow, you decide to use a tool that can reconstruct the control flow graph. Which tool feature is most important for this task?
Select an answer first
15expert · hard
You are analyzing a malware sample that uses junk instructions and opaque predicates. You have a limited-time engagement and need to produce a report on the malware's capabilities. You have access to both a debugger and a binary analysis framework with scripting. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.