Which of the following is an anti-analysis technique?

• A. Fake OS or hidden ephemeral computing
• B. Virtualization software
• C. Network graph
• D. Post incident activity

Answer: (A)

Anti-analysis techniques are methods designed to thwart malware analysis by making the sample behave differently in a debugging or sandboxed environment or by hiding its true actions. Fake OS or hidden ephemeral computing fits this because it presents a decoy operating system or a brief, ephemeral environment to mislead researchers and obscure what the malware would do in a real setting. Virtualization software, while a common tool for safe analysis, is not in itself an anti-analysis technique—it’s what analysts use to observe behavior, and some malware may try to detect such environments to evade execution, but the software itself isn’t the anti-analysis tactic. A network graph and post-incident activity don’t pertain to hindering analysis.