During a forensic investigation into a recent cyberattack, analysts discovered a piece of malware that...

Option A. Packer is the correct answer because CHFI v11 explicitly identifies program packers as an anti-forensics technique and also covers program packers unpacking tools as a way to reverse that concealment during analysis.

A packer is used to wrap or obfuscate an executable so that its real content is hidden from straightforward inspection. This often makes the malware appear unreadable or significantly harder to analyze until the packed layer is removed or unpacked. That fits the scenario exactly: the malicious functionality only became clear after the outer encrypted or packed layer was removed.

An exploit is code used to take advantage of a vulnerability, not primarily to hide malware. A payload is the malicious function delivered or executed after infection. A dropper is designed to install or deliver other malware components, but it is not the best term for the specific concealment layer described here. Therefore, within CHFI’s anti-forensics framework, the component most responsible for this type of obfuscation is a packer .