Phishing vs In-Memory Exploits for Fileless Malware Delivery

312-50v13 By islever Editorial Last updated

Social Engineering

Short answer

D Jack used Phishing to deliver the fileless malware by sending fraudulent emails with malicious links to employees.

Question

Jack, a disgruntled ex-employee of Incalsol Ltd., decided to inject fileless malware into Incalsol's systems. To deliver the malware, he used the current employees' email IDs to send fraudulent emails embedded with malicious links that seem to be legitimate. When a victim employee clicks on the link, they are directed to a fraudulent website that automatically loads Flash and triggers the exploit. What is the technique used by Jack to launch the fileless malware on the target systems?
  1. In-memory exploits
  2. Legitimate applications
  3. Script-based injection
  4. Phishing Correct Answer

Key Takeaways

The question asks for the 'technique used... to launch' the malware via email, which refers to the initial attack vector (Phishing) rather than the technical method of execution (In-memory exploits).

This question tests the distinction between delivery vectors and execution mechanisms in fileless malware attacks. The correct answer is D (Phishing), as it identifies the specific social engineering technique used to trick users into initiating the exploit.

Common mistake: Many candidates select A (In-memory exploits) because they focus on the 'fileless' aspect of the malware's execution. However, this option describes how the code runs, not how Jack delivered it to the victim via fraudulent emails.

Expert Analysis

Why the Answer Is Correct

The scenario explicitly states that Jack used "fraudulent emails embedded with malicious links" to direct victims to a site where the exploit occurred. This is the textbook definition of Phishing (Option D). The question asks for the technique used to launch or deliver the malware, which is the social engineering step of tricking the user.

Why the Other Options Are Wrong

Option A (In-memory exploits) describes the execution mechanism of fileless malware, not the delivery method. While accurate regarding the malware's behavior, it does not answer how Jack initiated the compromise. Option B (Legitimate applications) is incorrect because the delivery was through malicious links, not legitimate software usage. Option C (Script-based injection) is a technical detail of the exploit but ignores the primary human-centric attack vector described in the prompt.

Community Comment Notes

Community consensus correctly identified D as the answer. As NikoTomas noted, "They are asking for attack technique, which is Phishing (D) and not exploit type (in-memory exploit - A)." Another commenter, KiranYS, confirmed, "Yes, it is process of Phishing Attack." One dissenting view argued for A based on the fileless nature, but failed to address the delivery channel specified in the question.

Exam Strategy

When questions ask about the 'technique' or 'method' of an attack involving emails or deception, prioritize social engineering terms like Phishing over technical execution details like memory injection. Always align your answer with the specific action described (e.g., sending emails) rather than the underlying technology.

Frequently Asked Questions

Why isn't 'In-memory exploits' the correct answer?

In-memory exploits describe how the malware runs after execution. The question asks for the technique used to deliver or launch the attack, which was Phishing.

What defines a fileless malware attack in this context?

Fileless malware operates in RAM without writing files to disk. Here, the 'fileless' aspect refers to the exploit, while 'Phishing' refers to the delivery method.

More 312-50v13 FAQ →

Community Votes

D
67%
A
33%

67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Dogeo 👍 1 Answered A
    In-memory exploits are a form of attack where malware is executed directly in the system's memory without being written to disk. This means there are no traditional files involved in the attack, which makes it harder to detect using standard antivirus tools that rely on file signatures. In this scenario, Jack uses a fraudulent website to trigger an exploit, often involving a vulnerable Flash application that runs directly in memory. The Flash exploit then loads and executes the fileless malware without leaving any traces on the disk.
  2. NikoTomas 👍 1 Answered D
    They are asking for attack technique, which is Phishing (D) and not exploit type (in-memory exploit - A). So for me D.
  3. KiranYS 👍 1 Answered D
    Yes, it is process of Phishing Attack

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide