GREM Malicious Document File Forensics 2

Question 1

Which OLE2 stream in a malicious Word document typically contains VBA macro source code?

Accepted Answer

VBA/ThisDocument

Answer

The VBA/ThisDocument stream (or similar VBA streams) within the VBA storage container holds the compressed p-code and source code for macros.

Question 2

What does the OOXML relationship file (_rels/.rels or similar) reveal about a potentially malicious DOCX?

Accepted Answer

External targets such as remote template or OLE object URLs

Answer

Relationship files map document parts to their targets, and malicious documents often reference external URLs for remote template injection or linked OLE objects.

Question 3

A PDF contains the filter chain '/FlateDecode /ASCIIHexDecode'. What is the analyst's correct decoding order?

Accepted Answer

ASCIIHexDecode first, then FlateDecode

Answer

PDF filter chains are applied in reverse listed order during encoding, so decoding must proceed left to right: ASCIIHexDecode first, then FlateDecode.

Question 4

Which Excel 4.0 (XLM) macro function is most commonly abused to download and execute a second-stage payload?

Accepted Answer

CALL()

Answer

CALL() allows XLM macros to invoke arbitrary Windows API functions, making it the primary vector for downloading and executing payloads via URLDownloadToFile and similar APIs.

Question 5

What artifact in a malicious RTF file often signals shellcode embedded via \objdata?

Accepted Answer

A long unbroken hex string within an \object group

Answer

Shellcode or exploit data embedded in RTF \objdata fields appears as a dense, lengthy hex string within the \object group, often exploiting vulnerabilities like CVE-2017-11882.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Malicious Document File Forensics 2