Which type of tool hides malicious code through various techniques to evade detection and removal by security tools?

Which type of tool hides malicious code through various techniques to evade detection and removal by security tools?

• A. Obfuscator
• B. Crypter
• C. Packer
• D. Downloader

Answer: (A)

The concept being tested is how adversaries hide malicious code by transforming it to make analysis and detection difficult. An obfuscator works by making the program's structure harder to understand while keeping its behavior the same. It does this through a mix of techniques like renaming variables to meaningless names, inserting nonfunctional or junk code, altering control flow, and sometimes more advanced methods. The goal is to confuse automated security tools and human analysts, slowing or preventing detection and removal without changing what the code ultimately does. A crypter, on the other hand, mainly hides the payload by encrypting or encoding it and providing a decryptor to restore it at runtime. A packer hides code by compressing or packing it and then unpacking it during execution, which can also help evade some scanners. A downloader isn’t about hiding code at all; it’s designed to fetch additional payloads from a remote server.

The concept being tested is how adversaries hide malicious code by transforming it to make analysis and detection difficult. An obfuscator works by making the program's structure harder to understand while keeping its behavior the same. It does this through a mix of techniques like renaming variables to meaningless names, inserting nonfunctional or junk code, altering control flow, and sometimes more advanced methods. The goal is to confuse automated security tools and human analysts, slowing or preventing detection and removal without changing what the code ultimately does.

A crypter, on the other hand, mainly hides the payload by encrypting or encoding it and providing a decryptor to restore it at runtime. A packer hides code by compressing or packing it and then unpacking it during execution, which can also help evade some scanners. A downloader isn’t about hiding code at all; it’s designed to fetch additional payloads from a remote server.