A company wants to perform analysis of a tool that is suspected to contain a malicious payload. A forensic analyst is given the following snippet…

The correct answer is B. Binary reverse-engineering. A code deduplication removes multiple lines of the same code, this is not the output. Binary revers engineering could possibly result in this kind of information. Fuzztesting is a completely random output. There’s clearly structure here, so not this. Security Containers are…

Enterprise Security Operations

Question

A company wants to perform analysis of a tool that is suspected to contain a malicious payload. A forensic analyst is given the following snippet:

^32^[34fda19(fd^43gfd/home/user/lib/module.so.343jk^rfw(342fds43g Which of the following did the analyst use to determine the location of the malicious payload?

Options

ACode deduplicators
BBinary reverse-engineering
CFuzz testing
DSecurity containers

How the community answered

(53 responses)

A
2% (1)
B
79% (42)
C
6% (3)
D
13% (7)

Explanation

A code deduplication removes multiple lines of the same code, this is not the output. Binary revers engineering could possibly result in this kind of information. Fuzztesting is a completely random output. There’s clearly structure here, so not this. Security Containers are isolated code, and nothing like this.

Topics

#reverse engineering#malware analysis#binary analysis#obfuscation

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice