GREM Malicious Document File Forensics 2

Question 1

Which OLE2 stream in a malicious Word document typically contains VBA macro source code?

Accepted Answer

VBA/ThisDocument

Answer

WordDocument

Answer

1Table

Answer

SummaryInformation

Question 2

What does the OOXML relationship file (_rels/.rels or similar) reveal about a potentially malicious DOCX?

Accepted Answer

External targets such as remote template or OLE object URLs

Answer

The document's edit history

Answer

The list of embedded fonts

Answer

The document's revision number

Question 3

A PDF contains the filter chain '/FlateDecode /ASCIIHexDecode'. What is the analyst's correct decoding order?

Accepted Answer

ASCIIHexDecode first, then FlateDecode

Answer

FlateDecode first, then ASCIIHexDecode

Answer

Both are applied simultaneously

Answer

The order is irrelevant for PDF filters

Question 4

Which Excel 4.0 (XLM) macro function is most commonly abused to download and execute a second-stage payload?

Accepted Answer

CALL()

Answer

ARGUMENT()

Answer

EXEC()

Answer

NOW()

Question 5

What artifact in a malicious RTF file often signals shellcode embedded via \objdata?

Accepted Answer

A long unbroken hex string within an \object group

Answer

A high proportion of \pict tags

Answer

Multiple \stylesheet definitions

Answer

Excessive \fonttbl entries

Question 6

Which tool is purpose-built for extracting and decoding VBA macros from Office documents without executing them?

Accepted Answer

olevba

Answer

binwalk

Answer

volatility

Answer

foremost

Question 7

An analyst observes that a DOCX file's word/document.xml references an external template via a relationship with type 'attachedTemplate'. What attack technique does this indicate?

Accepted Answer

Remote template injection

Answer

Macro stomping

Answer

Excel 4.0 macro abuse

Answer

DDE command injection