Behaviors and methods that prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.

Two primary resources for anti-static analysis behaviors are [1] and [2].

Call Graph Generation Evasion M0010
Disassembler Evasion M0012
Executable Code Compression M0036
Executable Code Obfuscation M0032
Executable Code Optimization M0034
Executable Code Virtualization M0008

References

[1] Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project

[2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking