GIAC
GREM · Question #162
A sample uses heavy obfuscation and multiple layers of unpacking. Which approach is MOST effective?
The correct answer is C. Dump memory after OEP is reached. See the full explanation below for the reasoning.
Question
A sample uses heavy obfuscation and multiple layers of unpacking. Which approach is MOST effective?
Options
- AHash comparison with known malware
- BBehavioral sandboxing only
- CDump memory after OEP is reached
- DPE header re-alignment
How the community answered
(28 responses)- A7% (2)
- B4% (1)
- C86% (24)
- D4% (1)
Community Discussion
No community discussion yet for this question.