Using PEStudio, an analyst observes that a PE file...

PMRP Practice Questions - Practical Malware Research Professional (PMRP) Exam

Question Number 5

Using PEStudio, an analyst observes that a PE file's .text section has a calculated entropy value of 7.8. What is the most likely interpretation?

The section is likely packed or encrypted, hiding the real payload The code is heavily commented and human-readable The section is a standard resource section with PNG images Entropy of 7.8 is typical for unobfuscated compiled C code

✔ Correct Answer:

The section is likely packed or encrypted, hiding the real payload

PMRP Practice Questions - Practical Malware Research Professional (PMRP) Exam

Question Number 5

Count Down:

Related questions :