During triage of a suspicious Windows executable, an analyst observes that the .text section has an unusually high entropy value and the section names include .UPX0 and .UPX1. Which conclusion is most directly supported by these observations?

The binary is packed with a common packer and will need unpacking before meaningful static analysis.

The binary is a .NET assembly that uses native image generation.

The binary is encrypted with a custom algorithm and cannot be analyzed at all.

The binary is compiled with a high-optimization compiler that produces dense code.

When performing static analysis on a packed binary, which piece of information is most likely to be hidden or obfuscated and therefore require unpacking to reveal?

The actual API calls made by the malware's core logic

The compiler used to build the original program

After dumping an unpacked process, what is the primary purpose of rebuilding the import table?

To encrypt the dumped executable to protect it from analysis

To make the dumped executable runnable by restoring the correct API function references

To reduce the file size of the dumped executable

To remove anti-debugging checks from the executable

When stepping through an unpacking stub, why might an analyst use the 'Step Over' (F8) command instead of 'Step Into' (F7)?

To avoid getting stuck inside a long or complex function that is not part of the unpacking logic

To execute the entire unpacking routine in one step

To automatically dump the process memory at the end of the function

To prevent the malware from detecting the debugger

An analyst needs to unpack a malware sample packed with UPX. The goal is to obtain a runnable unpacked executable for further static analysis. Which approach is the most efficient and reliable?

Use the official UPX tool with the -d flag to decompress the executable

Run the sample in a sandbox and capture the unpacked payload from memory

Manually trace the unpacking stub in a debugger and dump the process memory

Use a generic unpacker like OllyDump without knowing the packer

GIAC Reverse Engineering Malware

Domain 5Objective 2

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 4)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 16–20

16foundation · medium
During triage of a suspicious Windows executable, an analyst observes that the .text section has an unusually high entropy value and the section names include .UPX0 and .UPX1. Which conclusion is most directly supported by these observations?
Select an answer first
17foundation · medium
When performing static analysis on a packed binary, which piece of information is most likely to be hidden or obfuscated and therefore require unpacking to reveal?
Select an answer first
18foundation · medium
After dumping an unpacked process, what is the primary purpose of rebuilding the import table?
Select an answer first
19foundation · medium
When stepping through an unpacking stub, why might an analyst use the 'Step Over' (F8) command instead of 'Step Into' (F7)?
Select an answer first
20application · easy
An analyst needs to unpack a malware sample packed with UPX. The goal is to obtain a runnable unpacked executable for further static analysis. Which approach is the most efficient and reliable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.