An analyst is examining a PE file and notices that the `.text` section has a virtual size of 0x1000 but a raw size of 0x200. The section's characteristics are `0x60000020` (code, execute, read). What is the most likely explanation for the discrepancy between virtual and raw sizes?

The section is a resource section that contains compressed resources.

The section contains uninitialized data that is zero-filled in memory.

The section is packed or compressed, and the raw data is smaller than the virtual size because it expands in memory.

The section is a standard code section, and the virtual size is larger due to alignment.

A malware sample imports `WriteProcessMemory`, `CreateRemoteThread`, and `VirtualAllocEx`. The sample also contains the string `C:\Windows\System32\calc.exe`. What is the most likely functionality of this malware?

The malware is a network worm that spreads by copying itself to `calc.exe`.

The malware is a file infector that modifies `calc.exe` on disk.

The malware is performing process injection to execute code in another process, possibly launching `calc.exe` as a payload.

The malware is a keylogger that uses these APIs to capture keystrokes.

Why is static analysis often the first step in malware analysis?

It is faster and safer than executing the sample, allowing quick triage

It automatically decrypts the malware's network traffic

It provides a complete understanding of the malware's runtime behavior

It guarantees the malware will be fully reverse engineered

Why do analysts compute multiple hashes (MD5, SHA-1, SHA-256) of a malware sample?

To recover the original file from the hash

To provide compatibility with different threat intelligence platforms

To speed up the analysis process

To ensure the file is not encrypted

A malware analyst is reviewing a sample that imports `CreateToolhelp32Snapshot`, `Process32FirstW`, and `Process32NextW`. The sample also contains the string `vmware` and `vbox`. What is the most likely purpose of these imports and strings?

The sample is enumerating running processes to detect virtual machines or analysis tools and may alter its behavior accordingly.

The sample is a dropper that uses process enumeration to find a target process to inject into.

The sample is a keylogger that monitors process creation to log keystrokes.

The sample is a process manager that lists running applications for the user.

GIAC Reverse Engineering Malware

Domain 1Objective 3

Static Analysis Fundamentals GREM Practice Questions (Page 3)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

Questions 11–15

11expert · hard
An analyst is examining a PE file and notices that the `.text` section has a virtual size of 0x1000 but a raw size of 0x200. The section's characteristics are `0x60000020` (code, execute, read). What is the most likely explanation for the discrepancy between virtual and raw sizes?
Select an answer first
12expert · hard
A malware sample imports `WriteProcessMemory`, `CreateRemoteThread`, and `VirtualAllocEx`. The sample also contains the string `C:\Windows\System32\calc.exe`. What is the most likely functionality of this malware?
Select an answer first
13foundation · easy
Why is static analysis often the first step in malware analysis?
Select an answer first
14foundation · easy
Why do analysts compute multiple hashes (MD5, SHA-1, SHA-256) of a malware sample?
Select an answer first
15expert · hard
A malware analyst is reviewing a sample that imports `CreateToolhelp32Snapshot`, `Process32FirstW`, and `Process32NextW`. The sample also contains the string `vmware` and `vbox`. What is the most likely purpose of these imports and strings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.