312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

While investigating a banking Trojan incident in Chicago, forensic analysts run a suspicious sample in a controlled analysis environment. The program immediately exits and changes its execution flow under these conditions, preventing analysts from observing its intended behavior. What malware-analysis aspect does this behavior demonstrate?

A Detection of analysis environments and modification of execution behavior
B Identifying malware components and behavioral traits
C Ensuring accurate and consistent analysis results
D Use of techniques such as encryption, code obfuscation, and artifact removal

Explanation

Malware may detect a sandbox, virtual machine, debugger, or other analysis environment and conditionally terminate or alter its execution path to evade behavioral observation. This is environment detection coupled with modified execution behavior.

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ409

Community Discussion