Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 9)

Questions 41–43

1. 41expert · hard

   A malware analyst is examining a suspicious executable that is heavily obfuscated. The analyst runs the executable in a sandbox and observes that it unpacks itself in memory, but the file on disk remains packed. The analyst also notices that the unpacked code is different each time the executable is run. Which combination of obfuscation techniques is being used?

   • ASteganography and packing
   • BOligomorphism and encryption
   • CPacking and polymorphism
   • DEncryption and metamorphism
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is analyzing a malware sample that is encrypted and only decrypts itself in memory when executed. The team also notices that the malware's decryption routine changes with each infection, but the overall behavior is the same. Which obfuscation technique is primarily being used, and what is the main limitation for static analysis?

   • APacking; the decryption stub is static, making it easy to detect
   • BPolymorphism; the code changes but the decryption routine is static
   • CEncryption; static analysis cannot read the encrypted payload without the key
   • DMetamorphism; the entire code is rewritten, making behavior analysis impossible
   Reveal Solution Discussion Select an answer first
3. 43foundation · easy

   Which malware type disguises itself as a legitimate file or program to trick users into executing it, often leading to a backdoor being installed?

   • ARootkit
   • BTrojan
   • CVirus
   • DAdware
   Reveal Solution Discussion Select an answer first