GSLC · Question #363
Which of the following viruses is designed to prevent antivirus researchers from examining its code by using various methods that make tracing and disassembling difficult?
The correct answer is A. Armored virus. An armored virus deliberately obstructs reverse engineering by embedding anti-debugging and code-obfuscation techniques.
Question
Which of the following viruses is designed to prevent antivirus researchers from examining its code by using various methods that make tracing and disassembling difficult?
Options
- AArmored virus
- BStealth virus
- CMultipartite virus
- DPolymorphic virus
How the community answered
(28 responses)- A89% (25)
- C7% (2)
- D4% (1)
Why each option
An armored virus deliberately obstructs reverse engineering by embedding anti-debugging and code-obfuscation techniques.
An armored virus uses techniques such as code confusion, anti-disassembly tricks, and anti-debugging routines specifically designed to mislead or crash analysis tools. This makes it extremely difficult for antivirus researchers to trace execution flow or examine the malicious payload. The 'armor' refers to protective layers in the code itself, not encryption of the payload.
A stealth virus hides its presence from the operating system and antivirus tools by intercepting system calls, not by obfuscating its code against disassembly.
A multipartite virus infects both the boot sector and executable files simultaneously - it targets multiple infection vectors rather than resisting analysis.
A polymorphic virus mutates its own code with each infection cycle to evade signature detection, but does not specifically target the disassembly or debugging process used by researchers.
Concept tested: Armored virus anti-analysis and anti-disassembly techniques
Source: https://www.techtarget.com/searchsecurity/definition/armored-virus
Topics
Community Discussion
No community discussion yet for this question.