Free GIAC GREM Exam Dumps Questions & Answers

What is a potential sign of malicious activity within a PDF file?

• A.Embedded JavaScript that performs obfuscation
• B.The inclusion of multiple compressed images
• C.A large number of document metadata fields
• D.The presence of embedded fonts

API hooking implemented by malware is primarily used for which purpose?

• A.Intercepting and possibly altering the function calls, messages, or events passed between software components
• B.Making the malware more detectable
• C.Increasing the speed of the malware execution
• D.Simplifying the malware code

Which fundamental static analysis techniques are used to examine malware without executing it?
(Choose two)

• A.Examining file headers for metadata
• B.Analyzing registry changes during execution
• C.Using a debugger to step through the code
• D.Viewing strings within the binary

When analyzing a ransomware sample you find code referencing CryptDeriveKey. What does this indicate?

• A.VM introspection
• B.Persistence payload
• C.Encryption routine
• D.Code signing

What is the primary use of a debugger in the context of unpacking malware?

• A.To automatically decompile the malware to high-level code
• B.To enhance the malware's obfuscation
• C.To generate signatures for antivirus software
• D.To execute malware step by step and observe its behavior