MBCProject-mbc-markdown/anti-static-analysis/executable-code-virtualization.md

ID	B0008
Objective(s)	Anti-Behavioral Analysis, Anti-Static Analysis
Related ATT&CK Techniques	None
Anti-Analysis Type	Evasion
Version	2.0
Created	1 August 2019
Last Modified	21 November 2022

Executable Code Virtualization

Original executable code is virtualized by translating the code into a special format that only a special virtual machine (VM) can run; the VM uses a customized virtual instruction set. A "stub" function calls the VM when the code is run. Virtualized code makes static analysis and reverse engineering more difficult; dumped code won’t run without the VM.

Virtualized code is a software protection technique. Themida is a commercial tool; VMProtect is an open source tool. [1]

Methods

Name	ID	Description
Multiple VMs	B0008.001	Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.

Use in Malware

Name	Date	Method	Description
Locky Bart	2017	--	Code virtualization is added to the Locky Bart binary using WPProtect. [2]

References

[1] https://github.com/xiaoweime/WProtect

[2] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/