mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
7f3bfe2c7d
* Update disable-or-evade-security-tools.md Added overwrite DLL .text section to remove hooks rule released in 7.2 * Update socket-communication.md Added rule "attach BPF to socket on Linux" released in v 7.2 * Update self-deletion.md Updated for congruence with CAPA 7.2 changes * Update hijack-execution-flow.md Updated APIs for "execute shellcode via Windows callback function" * Update software-packing.md Added "packed with nmm-protect" from CAPA 7.4
| ID | OB0002 |
| Created | 1 August 2019 |
| Last Modified | 12 June 2023 |
Anti-Static Analysis
Behaviors and code characteristics that prevent or hinder static analysis of the malware. Simple static analysis identifies features such as embedded strings, header information, or file metadata. More involved static analysis involves the disassembly of the binary code.
- Call Graph Generation Evasion B0010
- Disassembler Evasion B0012
- Data Flow Analysis Evasion B0045
- Executable Code Obfuscation B0032
- Executable Code Optimization B0034
- Executable Code Virtualization B0008
- Obfuscated Files or Information E1027
- Software Packing F0001
References
[1] https://search.unprotect.it/category/sandbox-evasion/
[2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking