SY0-301 · Question #901
Which of the following describes a type of malware which is difficult to reverse engineer in a virtual lab?
The correct answer is A. Armored virus. An armored virus is specifically designed to resist reverse engineering and analysis. It employs techniques such as confusing disassemblers, detecting debuggers, detecting virtual machine (VM) environments, and using obfuscated or self-modifying code to make analysis difficult…
Question
Which of the following describes a type of malware which is difficult to reverse engineer in a virtual lab?
Options
- AArmored virus
- BPolymorphic malware
- CLogic bomb
- DRootkit
How the community answered
(43 responses)- A95% (41)
- C2% (1)
- D2% (1)
Explanation
An armored virus is specifically designed to resist reverse engineering and analysis. It employs techniques such as confusing disassemblers, detecting debuggers, detecting virtual machine (VM) environments, and using obfuscated or self-modifying code to make analysis difficult. When run in a virtual lab, an armored virus may detect the VM environment and behave differently or not execute at all, thwarting analysis. Polymorphic malware changes its code signature to evade detection but can still be analyzed. A logic bomb triggers on specific conditions. A rootkit hides processes but is not specifically designed to resist reverse engineering.
Topics
Community Discussion
No community discussion yet for this question.