GREM Exam Questions

Which instructions or constructs are essential to understand when analyzing malware for anti- analysis techniques? (Choose Two)

Which of the following techniques can be used to defeat code obfuscation in malware?

In the context of malware analysis, what is the purpose of unpacking an executable?

Which techniques are commonly used for unpacking malware? (Choose two)

Which malware technique involves injecting code into a legitimate process to execute malicious activities?

What is a common sign that a PDF might be malicious?

Which tool or technique is most effective for identifying whether a Windows executable is packed?

Why is it important to analyze unpacked versions of malware?

Which registers are commonly used to pass function arguments in x86 assembly language? (Choose two)

Which of the following flow control structures is often used by malware to loop through a list of tasks or commands?

What is the primary goal of obfuscating malware code?

Which method can be used by malware to persist in Office documents through macros?

What is the primary purpose of using a disassembler in reverse engineering malware?

Which tool is typically used to debug packed Windows executables?

Which of the following tools or methods can be effectively used to analyze malicious RTF files? (Choose Two)

You are analyzing a malware sample that is packed and evades static analysis. During execution, the malware unpacks itself into memory. How would you proceed with the analysis? (Ch...

You are analyzing an obfuscated malware sample that has been packed using a custom packer. The malware also uses XOR encoding to obfuscate key strings, making static analysis diffi...

What aspect of a file is NOT typically considered during static analysis?

Why would a .NET malware analyst focus on the app.config or web.config files?

During static analysis of a suspicious executable, you notice it imports only LoadLibraryA and GetProcAddress. What is the MOST likely reason?

You execute the sample in a VM and observe it creates a new process using CreateProcess, then immediately suspends it and modifies its memory. What technique is this?

A malware sample checks the registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId What is the MOST likely purpose?

A malware dynamically allocates RWX memory and copies code into it. What is the BEST indication for next analysis step?

During network analysis, you observe HTTPS traffic with fixed-size periodic requests. Which behavior is MOST likely?

Which outcome indicates successful deobfuscation of malicious JavaScript?

Which of the following dynamic analysis tools is used to trace and debug malware execution?

What is the purpose of analyzing embedded scripts in a PDF file?

Why is it important to analyze the control words within an RTF document when investigating for malicious content?

Which of the following is a potential indicator that an Office macro is attempting to download additional payloads?

What would an analyst be looking for when examining the import address table (IAT) of a Windows PE file during malware analysis?

What features should a malware analysis lab have to ensure effective analysis? (Choose Three)

What is the primary goal of behavioral malware analysis?

Which of the following JavaScript features can be abused to obfuscate code?

What is the first step in behavioral analysis when dealing with a new malware sample?

Which technique can be used by malware to evade dynamic analysis tools?

In analyzing an RTF file, what is the significance of encountering large blocks of obfuscated or encoded data?

Which techniques are used by malware to misdirect analysts and evade reverse engineering? (Choose two)

What file structure is analyzed in the static analysis of a Windows executable?

Which of the following is the MOST reliable indicator that the payload is unpacked?

A PE file's .rsrc section contains an embedded executable. What is the MOST common malware characteristic?

When analyzing a ransomware sample you find code referencing CryptDeriveKey. What does this indicate?

Which condition MOST strongly confirms reflective DLL loading?

IsDebuggerPresent() returns false but debugging artifacts are detected. What is the malware likely doing?

A sample repeatedly checks CPU vendor strings. Which goal is MOST likely?

Which of the following are common flow control instructions used in malware? (Choose two)

Which of the following is a common obfuscation technique used in .NET malware?

Which API calls are commonly used by malware to manipulate processes and inject code? (Choose two)

In reverse engineering .NET malware, what does dynamic analysis allow you to observe?

Which assembly instruction is commonly used to alter the flow of execution in malware?

Which of the following indicators suggest the presence of .NET malware in a system? (Choose two)