GIAC
GREM · Question #117
You are analyzing an obfuscated malware sample that has been packed using a custom packer. The malware also uses XOR encoding to obfuscate key strings, making static analysis difficult. How would…
The correct answer is A. Use a dynamic analysis tool like a sandbox to observe the malware's behavior after unpacking. B. Use a debugger to step through the unpacking process and observe memory locations where the C. Manually decode the XOR-encoded strings by identifying the key used in the encoding process. See the full explanation below for the reasoning.
Question
You are analyzing an obfuscated malware sample that has been packed using a custom packer. The malware also uses XOR encoding to obfuscate key strings, making static analysis difficult. How would you proceed with the analysis? (Choose three)
Options
- AUse a dynamic analysis tool like a sandbox to observe the malware's behavior after unpacking.
- BUse a debugger to step through the unpacking process and observe memory locations where the
- CManually decode the XOR-encoded strings by identifying the key used in the encoding process.
- DDisassemble the packed binary to directly analyze its obfuscated code.
- EUse network monitoring tools to capture traffic generated by the malware.
How the community answered
(18 responses)- A72% (13)
- D22% (4)
- E6% (1)
Community Discussion
No community discussion yet for this question.