Which of the following types of instructions should the analyst use to understand how the malware was obfuscated and to help deobfuscate it?

During an incident investigation, a security analyst acquired a malicious file that was used as a backdoor but was not detected by the antivirus application. After performing a reverse-engineering procedure, the analyst found that part of the code was obfuscated to avoid signature detection.

Which of the following types of instructions should the analyst use to understand how the malware was obfuscated and to help deobfuscate it?
A . MOV
B . ADD
C . XOR
D . SUB
E . MOVL

View Answer

Answer: C