Which term describes malware that uses obfuscated or layered code to mislead disassembly and analysis?

Which term describes malware that uses obfuscated or layered code to mislead disassembly and analysis?

• A. Anti-disassembly
• B. Armored viruses
• C. Anti-heuristics
• D. Anti-emulation

Answer: (B)

Hiding the true instructions by wrapping and obfuscating the code to defeat reverse engineering is what armor does. Armored viruses are designed with protective layers around their payload—obfuscated or layered code, encrypted sections, and other tricks—that make static disassembly and analysis very difficult. This broad protective approach goes beyond simply trying to fool a single disassembler; it aims to shield the whole malware from both static and dynamic scrutiny. While anti-disassembly focuses on specific tricks to confuse disassemblers and anti-emulation targets emulation-based analysis, armor encompasses the overall strategy of obfuscation and layering to deter analysis in general. Anti-heuristics, on the other hand, is about evading heuristic-based detection, not about hindering analysis of the code itself.

Hiding the true instructions by wrapping and obfuscating the code to defeat reverse engineering is what armor does. Armored viruses are designed with protective layers around their payload—obfuscated or layered code, encrypted sections, and other tricks—that make static disassembly and analysis very difficult. This broad protective approach goes beyond simply trying to fool a single disassembler; it aims to shield the whole malware from both static and dynamic scrutiny. While anti-disassembly focuses on specific tricks to confuse disassemblers and anti-emulation targets emulation-based analysis, armor encompasses the overall strategy of obfuscation and layering to deter analysis in general. Anti-heuristics, on the other hand, is about evading heuristic-based detection, not about hindering analysis of the code itself.