Exam 312-49v10 All QuestionsBrowse all questions from this exam
Question 264

An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?

    Correct Answer: B

    To analyze packed software and identify the packaging software used, the investigator can use PEiD. PEiD is a popular tool for detecting packers, cryptors, and compilers used in executable files. It is widely used in malware analysis to identify the packing method used, which can help in further unpacking and analyzing the software. The other options listed do not specialize in detecting packing software: SysAnalyzer is for analyzing system files and registry entries, Comodo Programs Manager is used for managing installed software, and Dependency Walker is for analyzing dependencies and libraries of executable files.

Discussion
aqeel1506Option: B

The correct answer is B. PEiD. PEiD (PE Identifier) is a tool used to analyze Windows executable files (Portable Executable, PE) and identify the compiler, linker, and packer used to create the file. It can help investigators determine if a file has been packed or obfuscated, and which tool was used to do so. The other options are not correct: A. SysAnalyzer: A tool for analyzing system files and registry entries, not specifically designed for identifying packers. C. Comodo Programs Manager: A tool for managing installed software, not related to identifying packers. D. Dependency Walker: A tool for analyzing the dependencies and libraries used by executable files, not related to identifying packers.

aqeel1506Option: B

To analyze packed software and identify the packaging software used, the investigator can use: B. PEiD PEiD is a popular tool for detecting packers, cryptors, and compilers used in executable files. It is widely used in malware analysis to identify the packing method used, which can help in further unpacking and analyzing the software.

ElbOption: B

B > - detect which packer was used to pack the binary.