GREM Dumps (V8.02) Are Online for Your GIAC Reverse Engineering Malware (GREM) Certification Preparation: Check GREM Free Dumps (Part 1, Q1-Q40)

1. In reverse engineering .NET malware, what does dynamic analysis allow you to observe?

2. What features should a malware analysis lab have to ensure effective analysis? (Choose Three)

3. How can malware attempt to detect and respond to being run in a virtual machine? (Choose Three)

4. What would an analyst be looking for when examining the import address table (IAT) of a Windows PE file during malware analysis?

5. What is the primary goal of behavioral malware analysis?

6. Which API calls are commonly used by malware to manipulate processes and inject code? (Choose two)

7. In assembly language, which instruction is commonly used for conditional execution?

8. Which actions are typically performed by .NET malware and should be analyzed during reverse engineering? (Choose Two)

9. In analyzing macros, why is it important to examine the API calls made by the macros?

10. Which of the following behaviors could indicate that a macro in an Office document is malicious? (Choose two)

11. What is the first step in behavioral analysis when dealing with a new malware sample?

12. What can the analysis of import tables in an executable reveal about suspected malware?

13. How can obfuscated call instructions within malware be identified and analyzed? (Choose Two)

14. What is the primary goal of static analysis in malware reverse engineering?

15. You are analyzing a malware sample that appears to inject malicious code into the explorer.exe process. During execution, the malware creates a remote thread in explorer.exe and uses API calls to manipulate its memory.

How would you proceed with the analysis? (Choose three)

16. In PDF analysis, what is the significance of detecting a '/Launch' action within the document?

17. What is a key indicator that JavaScript code has been obfuscated?

18. In malware analysis, what does repairing unpacked malware refer to?

19. In analyzing an RTF file, what is the significance of encountering large blocks of obfuscated or encoded data?

20. What characteristic feature would analysts typically NOT expect to find in packed malware?

21. Which of the following indicators suggest the presence of .NET malware in a system? (Choose two)

22. What is the main purpose of using the SetWindowsHookEx function in malware?

23. When analyzing malicious software, what is an indicator of anti-emulation techniques being used?

24. When using a debugger on .NET malware, what would be a primary reason to set a breakpoint at a specific method?

25. Which of the following Windows API functions is commonly used by malware to alter the flow of execution within another process? (Choose Two)

26. Why is it important to identify and understand conditional branches when analyzing assembly code?

27. What is a common indicator that a function in assembly language is about to return a value?

28. What is one of the primary purposes of misdirection techniques used by malware?

29. API hooking implemented by malware is primarily used for which purpose?

30. Which techniques are used by malware to misdirect analysts and evade reverse engineering? (Choose two)

31. Which section in a PDF file typically stores the most important structure and object references for analysis?

32. 1.Which outcome indicates successful deobfuscation of malicious JavaScript?

33. Why is it important to analyze the control words within an RTF document when investigating for malicious content?

34. What file structure is analyzed in the static analysis of a Windows executable?

35. You are analyzing malware and notice a complex sequence of conditional branches and JMP instructions. The malware seems to randomly alter its execution flow based on certain conditions.

What steps should you take to fully understand its behavior? (Choose three)

36. When analyzing a Windows executable, which of the following indicators most strongly suggests that the file is packed?

37. Which of the following dynamic analysis tools is used to trace and debug malware execution?

38. Which of the following JavaScript features can be abused to obfuscate code?

39. What is the typical behavior of a malicious RTF file when opened in a vulnerable application?

40. Which of the following instructions is used to transfer control back to the calling function?