Exam 312-49v10 topic 1 question 694 discussion

C. Attempt to decrypt the password prior to unpacking the file The textbook emphasizes that before performing any detailed analysis (static or dynamic), the file needs to be unpacked. If the file is protected by a password or encrypted, decrypting it is a necessary step to access its content. This allows for accurate analysis of the file's true nature and contents. Only after decryption and unpacking can the investigator proceed with further analysis or reverse engineering.

CHFIv11 page 445: "...investigators must first decrypt the password to unpack the file" but also "Investigators can dynamically analyze...controlled environment..." as the malware brings with it the unpacking tool. Either C or D, though I'd lean on C?

Program packers that are password-protected can pose a challenge during investigation as investigators need to first decrypt the password to unpack the file.