MBCProject-mbc-markdown/anti-static-analysis/exe-code-compression.md

ID	M0036
Objective(s)	Anti-Behaviorial Analysis, Anti-Static Analysis, Defense Evasion
Related ATT&CK Technique(s)	Software Packing

Executable Code Compression

Executable Code Compression can make static and behavioral analysis difficult [1]. Methods related to anti-analysis are below.

This and the Executable Code Obfuscation behavior refine the ATT&CK Software Packing technique.

Methods

• Nested Packing: the malware is packed by one packer, the result is packed, etc.
• Standard Compression: Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.
• Standard Compression of Code: Uses a standard algorithm to compress the opcode mnemonics.
• Standard Compression of Data: Uses a standard algorithm to compress strings and variables (executable file data).
• Custom Compression: Uses a custom algorithm to compress an executable file.
• Custom Compression of Code: Uses a custom algorithm to compress opcode mnemonics.
• Custom Compression of Data: Uses a custom algorithm to compress strings and variables (executable file data).

Malware Examples

Name	Date	Description

References

[1] Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf

[2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.