GREM Exam Questions

When analyzing a PDF file for malicious content, why is it important to examine the file's metadata?

In analyzing macros, why is it important to examine the API calls made by the macros?

You are analyzing malware and notice a complex sequence of conditional branches and JMP instructions. The malware seems to randomly alter its execution flow based on certain condit...

Which tool is most commonly used to analyze JavaScript embedded within a malicious PDF?

What is the primary goal of static analysis in malware reverse engineering?

You are analyzing a malware sample in a debugger and notice the use of the CALL instruction followed by the manipulation of the EAX register. You suspect the malware is using custo...

When encountering obfuscated JavaScript within a webpage, what is the initial step an analyst should take?

Which tool is commonly used to extract metadata from a suspected malware file without executing it?

Which of the following behaviors could indicate that a macro in an Office document is malicious? (Choose two)

How can obfuscated call instructions within malware be identified and analyzed? (Choose Two)

In malware analysis, what does repairing unpacked malware refer to?

What techniques are commonly used by attackers in malicious RTF files? (Choose two)

In assembly language, which instruction is commonly used for conditional execution?

Which actions are typically performed by .NET malware and should be analyzed during reverse engineering? (Choose Two)

Which of the following indicators should raise suspicion when analyzing a PDF? (Choose Two)

In the context of PDF analysis, what does the term "JavaScript deobfuscation" typically refer to?

What is one of the primary purposes of misdirection techniques used by malware?

Which of the following file types can potentially be embedded within a malicious PDF? (Choose Two)

Which instructions are commonly used in the prologue of a function in x86 assembly? (Choose two)

When analyzing malicious software, what is an indicator of anti-emulation techniques being used?

What characteristic feature would analysts typically NOT expect to find in packed malware?

Which section in a PDF file typically stores the most important structure and object references for analysis?

What is the typical behavior of a malicious RTF file when opened in a vulnerable application?

In PDF analysis, what is the significance of detecting a '/Launch' action within the document?

Which of the following Windows API functions is commonly used by malware to alter the flow of execution within another process? (Choose Two)

What is a common indicator that a function in assembly language is about to return a value?

What is the primary reason attackers pack malware binaries?

API hooking implemented by malware is primarily used for which purpose?

What is a key indicator that JavaScript code has been obfuscated?

When analyzing a Windows executable, which of the following indicators most strongly suggests that the file is packed?

When using a debugger on .NET malware, what would be a primary reason to set a breakpoint at a specific method?

What is the primary objective of conducting a static analysis on a suspected malware file?

You are analyzing a malware sample that appears to inject malicious code into the explorer.exe process. During execution, the malware creates a remote thread in explorer.exe and us...

You are analyzing a malware sample in IDA Pro and identify a suspicious function written in assembly. The function uses multiple PUSH and MOV instructions and ends with a RET. How...

What does the presence of DllImport attribute indicate in a .NET assembly? (Choose Two)

In the context of .NET reverse engineering, what is the primary purpose of examining the Intermediate Language (IL) code?

What is the significance of the RET instruction in assembly language?

When analyzing a malware sample, why is it important to examine the strings contained within the binary?

What is the primary advantage of .NET malware for attackers?

What is the significance of analyzing the macro's trigger mechanism in a Microsoft Office document?

Which anti-analysis technique involves redirecting the execution flow of a program to unrelated instructions or loops?

Which tools are essential for performing static analysis on .NET malware? (Choose Two)

Which Windows API function is commonly used by malware to hide its presence from task managers and system monitors?

Which of the following tools is commonly used for basic static analysis of malware?

What is the primary use of a debugger in the context of unpacking malware?

Which fundamental static analysis techniques are used to examine malware without executing it? (Choose two)

Why might a malware analyst examine the conditional statements within a malware's assembly code?

Which of the following are reasons malware might use the VirtualAllocEx function? (Choose Two)

What methods do malware developers use to bypass static analysis? (Choose two)

What feature of PDFs can be abused to hide malicious content? (Choose Two)