GREM Malicious Document File Forensics 4

Question 1

Which PDF JavaScript API function is most frequently abused in heap spray exploits targeting Adobe Reader?

Accepted Answer

util.printf()

Answer

util.printf() was historically exploited due to a format string vulnerability that allowed arbitrary memory writes; it remains a classic heap spray vector in older CVEs.

Question 2

When a Word document exploits CVE-2017-11882 (Equation Editor), what process is typically the vulnerable one that executes shellcode?

Accepted Answer

EQNEDT32.EXE

Answer

CVE-2017-11882 exploits a stack buffer overflow in EQNEDT32.EXE, the legacy Equation Editor component that runs as a separate process when an equation object is opened.

Question 3

What is the purpose of the 'pcode2code' tool in malicious document analysis?

Accepted Answer

Decompiles VBA p-code back to readable source when source has been stomped

Answer

pcode2code decompiles compiled VBA p-code stored in module streams back into human-readable VBA source, allowing analysis even when the source stream has been macro-stomped.

Question 4

An OOXML document's [Content_Types].xml lists a part with ContentType 'application/vnd.ms-office.activeX+xml'. What does this indicate?

Accepted Answer

An ActiveX control is embedded in the document

Answer

The vnd.ms-office.activeX+xml content type identifies an embedded ActiveX control, which attackers abuse to execute code or trigger exploits when the document is opened.

Question 5

Which characteristic of a PDF stream would most strongly suggest it contains shellcode rather than compressed content?

Accepted Answer

Repeated byte patterns with entropy below 3.0

Answer

Shellcode often contains many NOP sleds and repeated patterns, resulting in low entropy; truly random or encrypted data has high entropy, while compressed legitimate data sits in the middle range.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Malicious Document File Forensics 4