GIAC
GREM · Question #139
Which of the following is the MOST reliable indicator that the payload is unpacked?
The correct answer is C. Full PE header appears in memory. See the full explanation below for the reasoning.
Question
Which of the following is the MOST reliable indicator that the payload is unpacked?
Options
- AStrings become readable
- BNew thread is created
- CFull PE header appears in memory
- DAPI calls are resolved
How the community answered
(36 responses)- A3% (1)
- B6% (2)
- C81% (29)
- D11% (4)
Community Discussion
No community discussion yet for this question.