This type of malware exploits system executables, Flash, Java, and documents to run a shellcode that injects a malicious payload into memory; it uses files to gain the initial entry. What is this called?

This type of malware exploits system executables, Flash, Java, and documents to run a shellcode that injects a malicious payload into memory; it uses files to gain the initial entry. What is this called?

• A. Legitimate applications
• B. Fileless malware
• C. File-based malware
• D. Native applications

Answer: (C)

This scenario centers on the idea of file-based malware. It relies on something stored on disk—an executable, a Flash/Java component, or a document—that is opened or processed to trigger code execution. The shellcode runs and injects a malicious payload into memory after that initial file-based entry, which is the hallmark of file-based infections. Fileless malware, by contrast, stays resident in memory and doesn’t depend on an on-disk file to begin the attack, often abusing legitimate tools or memory-resident techniques. Legitimate applications aren’t malicious, and “native applications” isn’t the term used for this behavior.

This scenario centers on the idea of file-based malware. It relies on something stored on disk—an executable, a Flash/Java component, or a document—that is opened or processed to trigger code execution. The shellcode runs and injects a malicious payload into memory after that initial file-based entry, which is the hallmark of file-based infections.

Fileless malware, by contrast, stays resident in memory and doesn’t depend on an on-disk file to begin the attack, often abusing legitimate tools or memory-resident techniques. Legitimate applications aren’t malicious, and “native applications” isn’t the term used for this behavior.