GIAC
GREM · Question #73
When analyzing .NET malware, which of the following findings would be considered significant? (Choose Three)
The correct answer is A. Use of obfuscation to hinder decompilation B. Presence of P/Invoke (Platform Invocation Services) calls C. Embedding of native DLLs within the .NET assembly. See the full explanation below for the reasoning.
Question
When analyzing .NET malware, which of the following findings would be considered significant? (Choose Three)
Options
- AUse of obfuscation to hinder decompilation
- BPresence of P/Invoke (Platform Invocation Services) calls
- CEmbedding of native DLLs within the .NET assembly
- DUsage of standard .NET libraries for file operations
- ECustom attributes that seem irrelevant to the application's core functionality
How the community answered
(23 responses)- A83% (19)
- D4% (1)
- E13% (3)
Community Discussion
No community discussion yet for this question.