Which set of tools is most appropriate for setting up a controlled dynamic analysis environment to observe the unpacking behavior of malware?

A hex editor and a disassembler (e.g., IDA Pro)

A file integrity checker and a hash calculator

A network sniffer and a packet analyzer

A debugger (e.g., x64dbg) and a process monitor (e.g., Process Monitor)

A security analyst receives a suspicious Windows executable from an incident response team. The file has a single section named .UPX0 with high entropy, and the import table contains only LoadLibrary and GetProcAddress. The analyst needs to confirm whether the file is packed before deciding on a dynamic analysis approach. Which action best confirms the packing and provides initial insight?

Run the file in a sandbox and capture network traffic to see if it downloads additional payloads.

Use a PE analysis tool to inspect section names, entropy, and import table anomalies, then compare against known packer signatures.

Submit the file to an online multi-engine antivirus scanner and review the detection names.

Execute the file in a debugger and step through the first few instructions to observe the unpacking stub.

A malware analyst is about to unpack a packed sample in a Windows VM. The sample is known to check for the presence of debugging tools and to attempt to detect virtualized environments. The analyst needs to set up a controlled environment that minimizes the chance of the sample detecting the analysis setup. Which setup step is most appropriate?

Use a VM with default settings and rely on the debugger's stealth mode to bypass all anti-debugging checks.

Use a bare-metal machine with no virtualization artifacts and run the debugger with anti-anti-debugging plugins enabled.

Install the debugger and process monitor on the host machine and attach to the VM process remotely.

Disable the VM's network adapter and run the sample without any monitoring tools to avoid detection.

An analyst has dumped an unpacked malware binary, but the dump has a broken import table. The analyst needs to rebuild the import table so the binary can be analyzed statically. Which approach is most effective?

Use a disassembler to identify imports and patch the binary manually

Manually add each import using a PE editor

Use Scylla to rebuild the import table from the running process

Re-run the unpacking process and dump again, hoping the import table is intact

GIAC Reverse Engineering Malware

Domain 5Objective 2

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 3)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 11–15

11foundation · medium
Which set of tools is most appropriate for setting up a controlled dynamic analysis environment to observe the unpacking behavior of malware?
Select an answer first
12foundation · medium
Which API function, when called, can reveal the presence of a debugger by checking the Process Environment Block (PEB) for the `BeingDebugged` flag?
Select an answer first
13application · medium
A security analyst receives a suspicious Windows executable from an incident response team. The file has a single section named .UPX0 with high entropy, and the import table contains only LoadLibrary and GetProcAddress. The analyst needs to confirm whether the file is packed before deciding on a dynamic analysis approach. Which action best confirms the packing and provides initial insight?
Select an answer first
14application · medium
A malware analyst is about to unpack a packed sample in a Windows VM. The sample is known to check for the presence of debugging tools and to attempt to detect virtualized environments. The analyst needs to set up a controlled environment that minimizes the chance of the sample detecting the analysis setup. Which setup step is most appropriate?
Select an answer first
15expert · hard
An analyst has dumped an unpacked malware binary, but the dump has a broken import table. The analyst needs to rebuild the import table so the binary can be analyzed statically. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 3)

Questions 11–15

Which set of tools is most appropriate for setting up a controlled dynamic analysis environment to observe the unpacking behavior of malware?

Which API function, when called, can reveal the presence of a debugger by checking the Process Environment Block (PEB) for the `BeingDebugged` flag?

An analyst has dumped an unpacked malware binary, but the dump has a broken import table. The analyst needs to rebuild the import table so the binary can be analyzed statically. Which approach is most effective?

Keep studying — Advanced Malware Analysis