An organization's security team has a policy that malware samples must not be executed on analyst workstations. An analyst receives a new sample and needs to determine if it is related to a known family. Which combination of static analysis actions would be most appropriate to achieve this without violating the policy?

Use a debugger to step through the sample's code and observe its behavior.

Compute the SHA-256 hash and compare it against known malware hashes, then examine the import table for family-specific API patterns.

Run the sample in a virtual machine and observe its network connections.

Upload the sample to VirusTotal and wait for the automated sandbox report.

What information can the compilation timestamp in the PE header provide to an analyst?

The exact time the malware was executed on a victim machine

The cryptographic hash of the file

The approximate date the binary was built

The number of sections in the file

An analyst is using PEiD to scan a malware sample. PEiD reports 'UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo'. What is the most appropriate next step for the analyst?

Attempt to unpack the sample using the UPX tool with the -d flag.

Ignore the PEiD result and manually analyze the raw bytes of the file.

Disassemble the sample from the entry point to understand the unpacking stub.

Run the sample in a sandbox to observe its behavior.

What is a common static indicator of sandbox evasion in malware?

Checking for the presence of specific DLLs or files commonly found in sandboxes

Using a high number of imported functions

What does the import table of a PE file reveal?

The sections and their permissions

The functions that the executable exports for other programs

The entry point address of the executable

The DLLs and functions that the executable uses from other libraries

GIAC Reverse Engineering Malware

Domain 1Objective 3

Static Analysis Fundamentals GREM Practice Questions (Page 6)

Part of the Malware Analysis Fundamentals domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

Questions 26–30

26application · medium
An organization's security team has a policy that malware samples must not be executed on analyst workstations. An analyst receives a new sample and needs to determine if it is related to a known family. Which combination of static analysis actions would be most appropriate to achieve this without violating the policy?
Select an answer first
27foundation · easy
What information can the compilation timestamp in the PE header provide to an analyst?
Select an answer first
28application · medium
An analyst is using PEiD to scan a malware sample. PEiD reports 'UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo'. What is the most appropriate next step for the analyst?
Select an answer first
29foundation · easy
What is a common static indicator of sandbox evasion in malware?
Select an answer first
30foundation · easy
What does the import table of a PE file reveal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.