Which technique is commonly used to bypass anti-VM checks in malware?

Patch the instructions that check for VM-specific hardware or registry keys

Increase the VM's memory to confuse the malware

Use a physical machine instead of a VM

Disable the VM's network adapter

Which combination of characteristics is most indicative of a packed executable?

A valid digital signature and a timestamp in the PE header

A large number of imports, low section entropy, and a section named .data

A small number of imports, high section entropy, and a section named .aspack

A single section with read-only attributes and a high file size

Which tool is specifically designed to automatically unpack executables packed with UPX?

UPX itself (with the -d option)

When analyzing an unpacked binary, which indicator is most useful for quickly identifying the malware's capabilities?

The list of imported API functions

The compiler used to build the binary

An analyst has a packed malware sample and needs to extract configuration data (e.g., C2 URLs) before unpacking. The sample is packed with a custom packer that does not have a known automated unpacker. Which static technique is most likely to reveal the configuration data?

Analyze the entropy of each section to identify the packed code

Search the binary for ASCII and Unicode strings using a strings tool

Inspect the import table for suspicious API calls

Run the sample in a debugger and break at the OEP

GIAC Reverse Engineering Malware

Domain 5Objective 2

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 5)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 21–25

21foundation · medium
Which technique is commonly used to bypass anti-VM checks in malware?
Select an answer first
22foundation · medium
Which combination of characteristics is most indicative of a packed executable?
Select an answer first
23foundation · medium
Which tool is specifically designed to automatically unpack executables packed with UPX?
Select an answer first
24foundation · medium
When analyzing an unpacked binary, which indicator is most useful for quickly identifying the malware's capabilities?
Select an answer first
25application · medium
An analyst has a packed malware sample and needs to extract configuration data (e.g., C2 URLs) before unpacking. The sample is packed with a custom packer that does not have a known automated unpacker. Which static technique is most likely to reveal the configuration data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.