GREM Exam Questions

Which of the following are common execution flow control mechanisms in assembly language? (Choose Two)

Which of the following is a common technique used to obfuscate JavaScript?

What is a key sign that a macro in a Microsoft Office document might be malicious?

What is the most effective method for analyzing obfuscated malware that uses dynamic code generation?

What assembly constructs could malware use to complicate static analysis? (Choose Three)

What behaviors in a PDF file could indicate malicious intent? (Choose two)

You are reverse-engineering a malware sample and observe that the executable checks for the presence of a debugger before launching its malicious payload. How would you proceed to...

Which static analysis techniques are commonly used to investigate malware? (Choose two)

Which of the following file attributes can be considered a static property when analyzing malware?

When a malware analyst encounters the use of system calls within a malware sample's assembly code, what is the significance?

What is a common anti-analysis technique that involves redirecting the malware's execution flow?

Why might malware use indirect jumps and calls as part of its execution flow?

Analyzing the decompressed content of an RTF file is essential for what reason?

In malware analysis, why is it important to identify the packer used in a malware sample?

Which methods are commonly used by malware authors to obfuscate their code? (Choose two)

Which technique is commonly used to obfuscate strings in malware?

You are analyzing a suspicious Office document received as an email attachment. Upon opening, you notice the document attempts to run a macro that accesses external servers and mak...

What aspects should be analyzed to determine if a macro in an Office file is self-replicating? (Choose Two)

Which of the following is a common technique used by attackers to exploit vulnerabilities in RTF files?

You are investigating a suspicious .NET malware sample that uses encrypted strings to hide its payload. You've identified the decryption routine. How would you proceed with the ana...

Which of the following is a sign that a malware sample is packed?

Which of the following is a common persistence mechanism used by malware?

When analyzing .NET malware, which of the following findings would be considered significant? (Choose Three)

In the context of malware analysis, what is the significance of identifying a call to the CreateProcess function with the CREATE_SUSPENDED flag?

Which of the following would be considered an advanced static analysis technique?

Which elements within an RTF document are critical to review for signs of exploitation or malicious activity? (Choose Two)

What is the primary purpose of analyzing loops in a malware sample?

Which of the following API calls is commonly used by malware to download additional payloads?

What role do conditional statements like CMP and JE play in malware flow control?

Which of the following actions should be scrutinized while analyzing macros in suspicious Office files? (Choose Two)

In the context of Office macros, what does the term "persistence" refer to?

Which technique can be utilized to hide malicious macro code within an Office document?

In the context of RTF file analysis, what purpose does examining hexadecimal content serve?

You are performing static analysis on a suspicious Windows executable. The file has an unusual section labeled .rsrc and imports numerous suspicious DLLs, such as advapi32.dll. Wha...

The use of which API function might indicate that malware is attempting to modify system-level settings or interfere with system processes?

Which Windows process is often targeted by malware for process injection techniques?

What is the significance of finding extensive use of System.Reflection namespace in a .NET malware sample?

Which approach can help in bypassing malware that employs timing checks to detect analysis tools?

What technique can be employed to analyze the behavior of a suspicious PDF without executing any malicious code?

Why would malware authors use the LoadLibrary API call within their code? (Choose Two)

What tool is commonly used to decompile .NET binaries for analysis?

Which of the following statements is true when dealing with malware that employs misdirection through code restructuring?

What is one way to investigate if a macro in an Office document is malicious?

Which register in x86 assembly is typically used to store the return value of a function?

In the analysis of a suspicious Office file's macro, which of the following elements would be crucial to investigate? (Choose Three)

Why would an analyst examine the timestamps within the metadata of a suspected malware file?

Which tool can be used to monitor network traffic during behavioral analysis of a malware sample?

You are analyzing a suspicious RTF file that is suspected of exploiting a buffer overflow vulnerability. The file contains multiple embedded OLE objects, and the content appears ob...

In assembly language analysis, what is typically the purpose of the EBP register within a function?

Which of the following are commonly observed behaviors in malware during behavioral analysis? (Choose two)