300-215 Question 24
Select 2During a forensic investigation, you analyze a suspicious email attachment. The attachment contains a script that, when inspected, includes strings encoded in Base64. After decoding, you discover that the script dynamically changes its code upon execution to evade detection. Which encoding and obfuscation techniques are being used in this scenario?
- A
Base64 encoding
- B
Hex encoding
- C
Polymorphic coding
- D
Metamorphic coding
- E
XOR encoding
Show answer and explanation
Correct answers: A, C
Explanation
The script in the scenario uses Base64 encoding to obfuscate its content, aligning with the description of encoded strings. Additionally, the script's ability to dynamically change its code upon execution is indicative of polymorphic coding, a common obfuscation technique used to evade detection. Other techniques like hex encoding, metamorphic coding, and XOR encoding are not relevant based on the provided details.
- A. Correct.
Base64 encoding is used to represent binary data in an ASCII string format, which aligns with the scenario where encoded strings were found in the script.
- B. Incorrect.
Hex encoding converts binary data to hexadecimal representation. There is no indication in the scenario that hex encoding was used.
- C. Correct.
Polymorphic coding refers to code that alters itself upon execution while maintaining its original functionality, which matches the script's behavior described in the scenario.
- D. Incorrect.
Metamorphic coding involves code that rewrites itself entirely to change its structure while performing the same function. This is not explicitly described in the given scenario.
- E. Incorrect.
XOR encoding is a basic encoding technique that uses XOR operations to obscure data. There is no mention of XOR encoding in the scenario.