The techniques used by malware developers to disguise their code and prevent it from being analyzed

The techniques used by malware developers to disguise their code and prevent it from being analyzed

Malware is exposed to an analysis by attackers who try their best to access this malware and get information that they can use for their gain. Different techniques are put in place by malware developers to disguise their code and prevent it from being analyzed to curb this. The techniques include code integration, code transportation, Armadillo, IceFog, Ultimate Packer for Executables, UPX, eXclusive OR, ASPR, and Themida. The available techniques are classified into three different ranks, which include wrapping, obfuscation, and Packers.

Ultimate Packer for Executables, UPX is an example that falls under the Packers’ category with other techniques like Enigma protector, EXE Bundle and Stealth, BoxedApp Packer, among other methods. Basile, Lioy, and Morgari (2020) reported that UPX is used as an outer layer in the malware scene to mask and prevent any interference effort, making it very difficult for an analyst to interpret or understand what is going on. For more safety purposes, writers use UPX and other customized parkers that are not detected by any Antivirus software. This makes it challenging to unpack scripts, and therefore the user manually unpacks his files. Analysts have access to the outer layers only, specifically when they are armed with unpacking tools.

Instruction subroutines is an obfuscation that performs an evolution or origination of the original code by replacing different instructions with several others equivalent to the original instructions. Chakkaravarthy, Sangeetha, and Vaidehi (2019) maintained that this technique ensures that the compromised system’s original code is retrieved. Analyzers never reach the codes due to the dead code insertion and code integration used in this technique.

In the event of disaster recovery documentation, the above techniques groupings are ranked into the three as wrapping (rank 1), obfuscation (rank 2), and packers (rank 3) techniques.

Using wrapping rank, Malware writers have devised a way to use traditional-based antimalware tools to detect malware. They have adapted malware attacks to avoid detection by the specific signature. Deka, Sarma, and Panicker (2016) reported that malware developers use legitimate files in coding to complicate malware detection. Once the malware is wrapped and configured with a legitimate file, it behaves so that once execution is done, it extracts or installs the legitimate file along with installing the malware.

Malware authors use obfuscation to stay invisible in compromised machines and disguise their codes to prevent analysis by the compromisers. Banescu, Collberg, Ganesh, Newsham, and Pretschner (2016) emphasized that in obfuscation, the malware authors insert dead codes that give ineffective instructions to programs to change appearance but not changing the behavior. Obfuscation also involves the use of registered assignments and subroutine reordering, making the original code undetectable by antivirus programs by changing the order of the code’s subroutines. This rank also uses instruction subroutines, code transportation, and code integration, making the malware attach itself to the code of its target program. This rank of techniques ensures that the malware is kept safe from the analysis by intruders.

Packers are also known as compressors or the self-extracting archive. This is a software that unpacks itself in the memory when the packed file is executed. Jaramillo (2018) reiterated that these techniques were used to make files smaller, but today’s malware authors use it for malicious purposes. When the software is attached to another legitimate secondary file, it makes reverse engineering more difficult. Packers include ASPack, ASPR, PESpin, Obsidium, Petite, among others.

The above order of classification and ranking helps in the recovery documentation process. The recovery starts with wrapping techniques followed by obfuscation and packing, where the malware unpack themselves in the places attached safely for retrieval.

 

Reference

Basile, C., Lioy, A., & Morgari, G. (2020). Techniques for Malware Analysis based on Symbolic Execution.

Chakkaravarthy, S. S., Sangeetha, D., & Vaidehi, V. (2019). A Survey on malware analysis and mitigation techniques. Computer Science Review, 32, 1-23.

Deka, D., Sarma, N., & Panicker, N. J. (2016, December). Malware detection vectors and analysis techniques: A brief survey. In 2016 International Conference on Accessibility to Digital World (ICADW) (pp. 81-85). IEEE.

Banescu, S., Collberg, C., Ganesh, V., Newsham, Z., & Pretschner, A. (2016, December). Code obfuscation against symbolic execution attacks. In Proceedings of the 32nd Annual Conference on Computer Security Applications (pp. 189-200).

Jaramillo, L. E. S. (2018). Malware Detection and Mitigation Techniques: Lessons Learned from Mirai DDOS Attack. Journal of Information Systems Engineering & Management, 3(3), 19.