An analyst has a malware sample packed with a custom packer that is not recognized by automated unpackers. The analyst needs to unpack the sample. Which approach is most appropriate?

Use a generic automated unpacker and hope it works

Submit the sample to an online unpacking service

Run the sample in a sandbox and capture the unpacked payload from memory

Manually trace the unpacking stub in a debugger and dump the process memory at the OEP

While debugging a packed binary, the debugger suddenly exits when the malware calls `IsDebuggerPresent`. Which debugging technique is most appropriate to bypass this anti-debugging check?

Run the binary in a virtual machine to avoid detection

Patch the return value of `IsDebuggerPresent` to 0 (or NOP the call)

Set a breakpoint on the OEP and continue execution

Disable the debugger's exception handling

Why is it important to use a virtual machine (VM) or a dedicated analysis host when dynamically analyzing packed malware?

To allow the malware to access the internet without restrictions

To automatically unpack the malware without manual intervention

To increase the speed of the unpacking routine

To isolate the malware and prevent it from infecting the analyst's production environment

An analyst wants to extract readable strings from a packed binary without executing it. Which tool or technique is most appropriate for this task?

Use a debugger to set a breakpoint at the OEP and then dump memory

Run the `strings` utility on the raw binary file

Run the binary in a sandbox and capture network traffic

Use a PE viewer to list the imported functions

While debugging a packed malware sample, the analyst notices that the program calls `IsDebuggerPresent` and then `OutputDebugString` with a specific string. The analyst wants to bypass these anti-debugging checks without altering the sample's behavior. Which technique is most appropriate?

Set a breakpoint on `IsDebuggerPresent` and modify the return value to 0

Hide the debugger from the process using a stealth plugin

Run the sample without a debugger and use API monitoring instead

Patch the call to `IsDebuggerPresent` to jump to the next instruction

GIAC Reverse Engineering Malware

Domain 5Objective 2

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 1)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 1–5

1application · medium
An analyst has a malware sample packed with a custom packer that is not recognized by automated unpackers. The analyst needs to unpack the sample. Which approach is most appropriate?
Select an answer first
2foundation · medium
While debugging a packed binary, the debugger suddenly exits when the malware calls `IsDebuggerPresent`. Which debugging technique is most appropriate to bypass this anti-debugging check?
Select an answer first
3foundation · medium
Why is it important to use a virtual machine (VM) or a dedicated analysis host when dynamically analyzing packed malware?
Select an answer first
4foundation · medium
An analyst wants to extract readable strings from a packed binary without executing it. Which tool or technique is most appropriate for this task?
Select an answer first
5application · medium
While debugging a packed malware sample, the analyst notices that the program calls `IsDebuggerPresent` and then `OutputDebugString` with a specific string. The analyst wants to bypass these anti-debugging checks without altering the sample's behavior. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.