GREM Malicious Document File Forensics 4

Question 1

Which PDF JavaScript API function is most frequently abused in heap spray exploits targeting Adobe Reader?

Accepted Answer

util.printf()

Answer

app.alert()

Answer

this.submitForm()

Answer

app.execMenuItem()

Question 2

When a Word document exploits CVE-2017-11882 (Equation Editor), what process is typically the vulnerable one that executes shellcode?

Accepted Answer

EQNEDT32.EXE

Answer

winword.exe

Answer

msiexec.exe

Answer

dllhost.exe

Question 3

What is the purpose of the 'pcode2code' tool in malicious document analysis?

Accepted Answer

Decompiles VBA p-code back to readable source when source has been stomped

Answer

Converts Python exploit code to p-code format

Answer

Extracts shellcode from PDF streams

Answer

Converts XLM macros to VBA syntax

Question 4

An OOXML document's [Content_Types].xml lists a part with ContentType 'application/vnd.ms-office.activeX+xml'. What does this indicate?

Accepted Answer

An ActiveX control is embedded in the document

Answer

The document contains embedded fonts

Answer

The document uses legacy binary format

Answer

A linked spreadsheet is present

Question 5

Which characteristic of a PDF stream would most strongly suggest it contains shellcode rather than compressed content?

Accepted Answer

Repeated byte patterns with entropy below 3.0

Answer

High entropy values close to 8.0 bits/byte

Answer

A /Length value matching the stream exactly

Answer

The presence of /FlateDecode as the only filter

Question 6

What is the significance of the 'AutoOpen' or 'Document_Open' subroutine name in a VBA macro?

Accepted Answer

It causes the macro to execute automatically when the document is opened

Answer

It marks the macro as password-protected

Answer

It registers the macro as a trusted publisher

Answer

It signals that the macro requires admin privileges

Question 7

Which technique allows an attacker to hide malicious XLM macros in a very large spreadsheet so that automated tools may miss them?

Accepted Answer

Storing macros in cells with white text on a white background far from cell A1

Answer

Placing macros in the SummaryInformation stream

Answer

Encoding macros using Base64 within a formula comment

Answer

Embedding macros inside a chart object's data series