Which of the following is a common obfuscation technique used in .NET malware?

Question

Options

• AString encryption
• BPacked sections
• CCode injection
• DProcess hollowing

• A
  76% (34)
• B
  4% (2)
• C
  7% (3)
• D
  13% (6)

Explanation

String encryption is the correct answer because it is a technique specific to managed code environments like .NET, where tools such as ConfuserEx, Eazfuscator, or DNGuard encrypt string literals at compile time and decrypt them at runtime - making static analysis difficult without deobfuscation. This is one of the most prevalent obfuscation techniques seen in .NET malware families.

Why the distractors are wrong:

• B (Packed sections): Packing (e.g., UPX) compresses or encrypts native PE sections and is primarily a technique for native/unmanaged executables - it's not an obfuscation technique specific to .NET, whose IL bytecode lives in managed assemblies, not traditional PE sections.
• C (Code injection): Code injection is a post-execution persistence/evasion technique (injecting shellcode into another process), not an obfuscation technique - it doesn't hide the malware's code from analysis.
• D (Process hollowing): Similarly, process hollowing is a runtime execution technique that spawns a legitimate process and replaces its memory, not a method for obscuring the malware's own source code or assembly structure.

Memory tip: Think ".NET = strings." .NET malware authors know that decompilers like dnSpy or ILSpy can trivially reconstruct readable C# source code from IL bytecode - so encrypting strings is their first line of defense against static analysis. When you see .NET malware + obfuscation, your default answer is string encryption.

No community discussion yet for this question.