What type of information is typically found in the Version Info resource of a PE file?

Product name, company name, and file version

A malware analyst is examining a suspicious executable and wants to determine what Windows API functions it imports. The analyst opens the file in CFF Explorer and navigates to the import table. Which finding would be most suspicious and warrant further investigation?

The import table includes advapi32.dll with functions like RegOpenKeyEx and CryptAcquireContext.

The import table includes ws2_32.dll with functions like socket and connect.

The import table lists only kernel32.dll and user32.dll with common functions like CreateFile and MessageBox.

The import table is empty, and the file has a high entropy section named .packed.

While analyzing a malware sample, an analyst finds a string that reads `sandboxie` and imports for `GetTickCount` and `Sleep`. What is the most likely purpose of these indicators?

The sample is a keylogger that uses timing functions to capture keystrokes at intervals.

The sample is attempting to detect if it is running in a sandbox and may delay execution to evade analysis.

The sample is packed, and these strings are part of the unpacking routine.

The sample is a legitimate application that uses timing functions for performance monitoring.

An analyst extracts strings from a malware sample and finds the string `http://192.168.1.100/update` and the API name `WinExec`. The sample also contains the string `cmd.exe /c del %s`. What is the most likely functionality?

The malware is a keylogger that sends keystrokes to the URL.

The malware is a worm that spreads by copying itself to the URL.

The malware is a ransomware that encrypts files and demands payment at the URL.

The malware downloads a file from the URL and executes a command to delete a file, likely for cleanup or self-deletion.

GIAC Reverse Engineering Malware

Domain 1Objective 3

Static Analysis Fundamentals GREM Practice Questions (Page 1)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

Questions 1–5

1foundation · easy
What type of information is typically found in the Version Info resource of a PE file?
Select an answer first
2application · medium
A malware analyst is examining a suspicious executable and wants to determine what Windows API functions it imports. The analyst opens the file in CFF Explorer and navigates to the import table. Which finding would be most suspicious and warrant further investigation?
Select an answer first
3application · medium
While analyzing a malware sample, an analyst finds a string that reads `sandboxie` and imports for `GetTickCount` and `Sleep`. What is the most likely purpose of these indicators?
Select an answer first
4expert · hard
An analyst extracts strings from a malware sample and finds the string `http://192.168.1.100/update` and the API name `WinExec`. The sample also contains the string `cmd.exe /c del %s`. What is the most likely functionality?
Select an answer first
5foundation · easy
In a PE file, which field specifies the address where execution begins?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.