In manual unpacking with a debugger, what is the purpose of setting a breakpoint at the Original Entry Point (OEP)?

To identify the packer used by the malware

To pause execution when the unpacking stub has finished and the original code is about to run

To skip the unpacking routine and directly analyze the original code

To prevent the malware from executing its malicious payload

After successfully unpacking a malware sample, what is the most effective way to understand its core functionality?

Run the packed binary in a sandbox and observe its network traffic

Delete the unpacked binary and rely on the original packed sample for analysis

Only use automated unpacking tools to get a clean binary

Analyze the unpacked binary using static analysis (e.g., disassembly) and dynamic analysis (e.g., running it in a sandbox)

A malware sample checks the BIOS serial number and the presence of a specific kernel driver to detect a virtual machine. The analyst needs to bypass these checks to continue debugging. Which approach is most effective?

Patch the conditional jump instructions that follow the checks to always take the 'not a VM' path

Run the sample on physical hardware to avoid VM detection

Use a debugger plugin that automatically skips anti-VM functions

Change the VM settings to hide the BIOS serial number and remove the kernel driver

An analyst is triaging a large number of binaries and needs to quickly identify which ones are likely packed. Which combination of static indicators is most indicative of packing?

A large number of imports and a low entropy section

High entropy in a section and an import table with only LoadLibraryA and GetProcAddress

A digital signature and a valid certificate

A section named .text and a small virtual size

An analyst is manually unpacking a malware sample. After tracing the unpacking stub, the analyst reaches a `jmp` instruction that jumps to a region of memory that appears to be the original code. What should the analyst do next to obtain a usable unpacked binary?

Terminate the process and use a static unpacker

Step over the jump and then dump the memory

Dump the process memory immediately at the current instruction

Set a breakpoint on the jump target, execute to it, then dump the process memory

GIAC Reverse Engineering Malware

Domain 5Objective 2

Unpacking and Debugging Packed Malware GREM Practice Questions (Page 6)

Part of the Advanced Malware Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 26–30

26foundation · medium
In manual unpacking with a debugger, what is the purpose of setting a breakpoint at the Original Entry Point (OEP)?
Select an answer first
27foundation · medium
After successfully unpacking a malware sample, what is the most effective way to understand its core functionality?
Select an answer first
28expert · hard
A malware sample checks the BIOS serial number and the presence of a specific kernel driver to detect a virtual machine. The analyst needs to bypass these checks to continue debugging. Which approach is most effective?
Select an answer first
29application · medium
An analyst is triaging a large number of binaries and needs to quickly identify which ones are likely packed. Which combination of static indicators is most indicative of packing?
Select an answer first
30application · medium
An analyst is manually unpacking a malware sample. After tracing the unpacking stub, the analyst reaches a `jmp` instruction that jumps to a region of memory that appears to be the original code. What should the analyst do next to obtain a usable unpacked binary?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.