CEH Cryptography and Malware Analysis Practice Question

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

⚠ Common exam trap

EC-Council often tests the distinction between anti-debugging and anti-VM techniques; the trap here is that candidates confuse resource-based checks (like CPU cores) with debugger detection, but anti-debugging specifically targets debugger artifacts, not hardware resource enumeration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Anti-VM / sandbox evasion

Checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Code obfuscation
Why it's wrong here
Code obfuscation is a technique employed by malware authors to make their code difficult for human analysts and automated tools to understand and reverse engineer. This is achieved through methods like junk code insertion, control flow flattening, string encryption, or renaming variables. Its primary goal is to hinder static analysis and intellectual property theft, not to detect the characteristics of a virtualized environment or sandbox by querying system resource counts.
✗
Anti-debugging
Why it's wrong here
Anti-debugging techniques are specifically designed to detect the presence of a debugger attached to a process or to impede its functionality. Malware uses these methods, such as checking for debugger-specific API calls, timing anomalies, or process environment block flags, to prevent dynamic analysis. While critical for evading real-time inspection, anti-debugging does not typically involve querying system hardware resources like CPU cores or memory size to identify a virtual machine or sandbox environment.
✓
Anti-VM / sandbox evasion
Why this is correct
Anti-VM and sandbox evasion techniques are employed by malware to determine if it is executing within a virtualized environment or an automated analysis sandbox, which often have deliberately limited resources. Checking for low CPU core counts, minimal RAM, small disk sizes, or generic hardware identifiers are common heuristics used by malware to detect these environments. If such conditions are met, the malware may alter its behavior, remain dormant, or self-terminate to avoid detection and analysis, thus preserving its efficacy.
✗
Packing
Why it's wrong here
Packing involves compressing or encrypting an executable's original code and data, typically to reduce its size and evade static signature-based detection by antivirus software. The packed executable contains a small stub that unpacks the original code into memory at runtime before execution. This technique primarily targets file-based detection and does not involve querying system resource attributes like CPU or memory to identify a virtual machine or sandbox environment; its focus is on altering the file's static signature.

Go deeper

CEH Cryptography and Malware Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question