GIAC
GREM · Question #70
You are investigating a suspicious .NET malware sample that uses encrypted strings to hide its payload. You've identified the decryption routine. How would you proceed with the analysis? (Choose…
The correct answer is A. Use dnSpy to decompile the .NET binary and locate the decryption function. B. Manually decrypt the strings using the identified routine and analyze their contents. C. Run the sample in a debugger to identify any API calls made after string decryption. See the full explanation below for the reasoning.
Question
You are investigating a suspicious .NET malware sample that uses encrypted strings to hide its payload. You've identified the decryption routine. How would you proceed with the analysis? (Choose three)
Options
- AUse dnSpy to decompile the .NET binary and locate the decryption function.
- BManually decrypt the strings using the identified routine and analyze their contents.
- CRun the sample in a debugger to identify any API calls made after string decryption.
- DAnalyze network traffic using Wireshark while the sample runs.
- EPatch the binary to bypass the string encryption routine.
How the community answered
(44 responses)- A75% (33)
- D9% (4)
- E16% (7)
Community Discussion
No community discussion yet for this question.