How Should an Investigator Examine a Password-Protected Packed Executable?
A forensic investigator encounters a suspicious executable on a compromised system, believed to be packed using a known program packer, and is password-protected. The investigator has knowledge of the tool used for packing and has the corresponding unpacking tool. What should be the next best course of action to examine the executable?
Community Votes
75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that password protection is a separate barrier from packing; the trap is assuming a known unpacking tool can decompress the executable without first decrypting the password.
This question tests how a malware forensic investigator handles a suspicious executable that is packed with a known program packer and protected by a password. The page establishes that the next best action is to decrypt the password so the corresponding unpacking tool can unpack the executable before analysis.
The most common wrong answer is A, because learners assume the matching unpacking tool can bypass or ignore the password and decompress the executable directly.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is correct because the executable is both packed and password-protected. A matching unpacking tool is necessary but not sufficient when the packed container is protected; the investigator must first decrypt or supply the password so the tool can access and unpack the payload. CHFI guidance quoted in the comments says that for password-protected files investigators should "first decrypt the password to unpack the file." Once unpacked, the executable can be examined statically or dynamically. This makes C the prerequisite step, not an optional detour.Why the Other Options Are Wrong
A assumes the unpacker can decompress without dealing with the password, which contradicts the password-protected condition; the tool would still be blocked by the password gate. B may be useful later, and Elb notes packed programs may self-unpack at runtime, but dynamic execution of the still-packed sample is not the best next step when the known unpacker and password path are available. D jumps to reverse engineering the hidden attack tool before the packed executable has been unpacked, making the analysis harder and potentially missing the payload. None of these directly resolves the password-protection issue that the question highlights.Community Comment Notes
A commenter, 044f354, cites CHFI Module 05 and states that for password-protected files the investigator must "First decrypt the password to access/unpack the file." Another comment by Elb supports dynamic analysis for packed executables because they may contain built-in unpackers, but this is a later runtime technique and does not replace decryption for the known unpacking tool. User aqeel1506 argues for option A as efficient, but that argument assumes the tool can bypass the password, which the question does not establish. The overall comment thread and vote pattern favor C, consistent with the CHFI guidance.Official Reference
Exam Strategy
When a question mentions both packing and a password, treat the password as the first barrier: a matching unpacker cannot help until the protected container is decrypted. Eliminate options that skip decryption or jump to dynamic or reverse engineering before the file can be unpacked.
Frequently Asked Questions
Why can’t the matching unpacking tool decompress the executable without the password?
Password-protected packers gate the packed payload, so the unpacker needs the password to produce a usable unpacked file. Option A skips a required decryption step.
Is dynamic analysis of the packed executable a valid alternative?
It can observe runtime behavior, but with a password-protected known packer the recommended next step is C: decrypt and unpack before deeper static or dynamic analysis.