Free GIAC GREM Exam Dumps Questions & Answers

What is the significance of identifying obfuscated code within a macro?

• A.It may indicate attempts to hide malicious code from analysis.
• B.It ensures compatibility across different Office platforms.
• C.It typically signifies the presence of intellectual property.
• D.It enhances the macro's performance.

What is a common sign that a PDF might be malicious?

• A.It triggers security warnings when opened.
• B.It contains extensive text and few images.
• C.The PDF is viewable on multiple platforms.
• D.The file size is smaller than average for similar documents.

Why would malware authors use the LoadLibrary API call within their code? (Choose Two)

• A.To load a specific module into the address space of the calling process
• B.To create a new execution thread
• C.To modify the system registry
• D.To dynamically link additional malicious code at runtime

In the x86 calling convention, where is the return address of a function typically stored?

• A.ESP
• B.EBP
• C.Stack
• D.EAX

What methods do malware developers use to bypass static analysis? (Choose two)

• A.Using API hashing to resolve functions dynamically
• B.Employing encrypted communication protocols
• C.Compressing executable files to reduce their size
• D.Obfuscating strings used in the malware