Certified Ethical Hacker (CEH) Practice Question

The observed program is functioning as a dropper. A dropper is a self-contained installer that carries a second‐stage payload inside itself, decrypts or unpacks that payload at run-time, writes it to disk (or memory), and executes it-often deleting the written file afterward to hinder forensic analysis. A crypter's main purpose is to obfuscate or encrypt another executable so it can bypass detection, but it does not necessarily handle deployment. A downloader's job is to contact a remote site to retrieve additional malware rather than carrying it locally. A file binder (wrapper) simply combines two or more files into one; it does not automatically decrypt, write, and run the embedded code. Therefore, the correct classification for the described behavior is a dropper.