A sample repeatedly checks CPU vendor strings. Which goal is MOST likely?

Question

Options

• ADetect Intel VT-x
• BDetect virtualization
• CEnable encryption
• DBypass firewall

• A
  16% (8)
• B
  74% (37)
• C
  6% (3)
• D
  4% (2)

Explanation

Checking CPU vendor strings is a classic anti-analysis technique used by malware to detect whether it's running inside a virtual machine (e.g., VMware, VirtualBox, Hyper-V). Hypervisors often expose identifiable vendor strings like "KVMKVMKVM" or "VMwareVMware" via the CPUID instruction, so repeatedly querying these strings signals the sample is trying to confirm it's in a real physical environment before executing its malicious payload.

Why the distractors are wrong:

• A (Detect Intel VT-x): VT-x is a hardware virtualization feature, but checking vendor strings is not how software detects VT-x support - that uses specific CPUID flag bits, not vendor ID strings.
• C (Enable encryption): CPU vendor identification has no role in enabling encryption; cryptographic routines use algorithm-specific APIs and keys.
• D (Bypass firewall): Firewalls operate at the network layer; CPU vendor strings are entirely unrelated to network traffic filtering.

Memory tip: Think "VM check = vendor string check." Malware authors know analysts run samples in VMs, so the sample "asks the CPU who made it" - if the answer sounds like a hypervisor, it hides. Vendor string → virtualization detection.

No community discussion yet for this question.