Which of the following is NOT an anti-analysis technique?

• A. Metadata scrubbing
• B. Fake OS or hidden ephemeral computing
• C. Legacy media
• D. Encryption

Answer: (C)

Anti-analysis techniques are actions taken to slow down, mislead, or defeat someone trying to analyze malware or suspicious activity. Metadata scrubbing removes fingerprint clues such as author info, timestamps, and tool traces, making forensic timelines harder to reconstruct. Presenting a fake operating system or ephemeral computing creates a misleading environment that can cause automated analyzers and researchers to draw incorrect conclusions or fail to observe real behavior. Encryption blocks direct inspection of payloads or data without the proper keys, forcing analysts to invest extra effort to decrypt or bypass it.

Legacy media, on the other hand, isn’t a deliberate method to hinder analysis. Using old storage media is more about practicality or compatibility concerns than about actively confusing or thwarting analysis. It may complicate certain workflows, but it doesn’t inherently implement a mechanism to defeat forensic or dynamic analysis.