You are analyzing a malware sample that uses control flow flattening and also inserts junk instructions in each basic block. You have a decompiler that can handle control flow flattening but the junk instructions are confusing the decompiler. What is the best way to proceed?

Run the decompiler first and manually ignore the junk instructions in the output.

Manually remove the junk instructions from the binary using a hex editor.

Use a debugger to step through the code and ignore the junk instructions.

First remove the junk instructions using a script, then run the decompiler.

You are analyzing a malware sample that uses misdirection techniques such as junk instructions, opaque predicates, and fake API calls. You have a limited time and need to produce a report on the malware's capabilities. You have access to a sandbox and a static analysis tool. What is the most effective approach?

Run the malware in the sandbox and use the static analysis tool to correlate the observed behavior with the code.

Manually deobfuscate the entire binary before running it in the sandbox.

Use only the static analysis tool to analyze the code.

Use only the sandbox to observe the behavior.

During malware analysis, you encounter a conditional jump that always evaluates to true because the condition depends on an arithmetic expression that is invariant at runtime (e.g., x^2 + 1 > 0). This is an example of an opaque predicate. What is the best way to handle this construct to simplify the control flow graph?

Keep the conditional jump and analyze both branches to ensure completeness.

Change the condition to always false to see the other branch.

Remove the entire block containing the predicate.

Replace the conditional jump with an unconditional jump to the taken branch.

A security analyst is reviewing a malware sample that uses multiple misdirection techniques, including junk code, opaque predicates, and fake API calls. The analyst wants to identify the actual malicious behavior quickly. Which approach is most effective?

Search for known malware signatures in the binary.

Perform dynamic analysis and monitor the API calls that are actually executed.

Remove all junk instructions and opaque predicates manually.

Statically analyze all API calls in the import table.

While analyzing a malware sample, you find a function that appears to contain many conditional branches, but upon closer inspection, many of the conditions are always true or always false (opaque predicates). You want to recover the actual control flow. Which technique is most effective?

Use a symbolic execution engine to evaluate the conditions and mark branches that are always taken or never taken.

Use a debugger to set breakpoints on every conditional jump and manually record the outcome.

Use a taint analysis tool to track which branches are actually taken during execution.

Use a binary diffing tool to compare the sample with a known clean version.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 4)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 16–20

16expert · hard
You are analyzing a malware sample that uses control flow flattening and also inserts junk instructions in each basic block. You have a decompiler that can handle control flow flattening but the junk instructions are confusing the decompiler. What is the best way to proceed?
Select an answer first
17expert · hard
You are analyzing a malware sample that uses misdirection techniques such as junk instructions, opaque predicates, and fake API calls. You have a limited time and need to produce a report on the malware's capabilities. You have access to a sandbox and a static analysis tool. What is the most effective approach?
Select an answer first
18application · medium
During malware analysis, you encounter a conditional jump that always evaluates to true because the condition depends on an arithmetic expression that is invariant at runtime (e.g., x^2 + 1 > 0). This is an example of an opaque predicate. What is the best way to handle this construct to simplify the control flow graph?
Select an answer first
19application · medium
A security analyst is reviewing a malware sample that uses multiple misdirection techniques, including junk code, opaque predicates, and fake API calls. The analyst wants to identify the actual malicious behavior quickly. Which approach is most effective?
Select an answer first
20application · hard
While analyzing a malware sample, you find a function that appears to contain many conditional branches, but upon closer inspection, many of the conditions are always true or always false (opaque predicates). You want to recover the actual control flow. Which technique is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Overcoming Misdirection Techniques GREM Practice Questions (Page 4)

Questions 16–20

You are analyzing a malware sample that uses control flow flattening and also inserts junk instructions in each basic block. You have a decompiler that can handle control flow flattening but the junk instructions are confusing the decompiler. What is the best way to proceed?

A security analyst is reviewing a malware sample that uses multiple misdirection techniques, including junk code, opaque predicates, and fake API calls. The analyst wants to identify the actual malicious behavior quickly. Which approach is most effective?

While analyzing a malware sample, you find a function that appears to contain many conditional branches, but upon closer inspection, many of the conditions are always true or always false (opaque predicates). You want to recover the actual control flow. Which technique is most effective?

Keep studying — Malware Patterns and Obfuscation