mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
34 lines
2.1 KiB
Markdown
34 lines
2.1 KiB
Markdown
|||
|
|
|---------|------------------------|
|
|
|**ID**|**M0036**|
|
|
|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
|
|**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
|
|
|
|
Executable Code Compression
|
|
===========================
|
|
Executable Code Compression can make static and behavioral analysis difficult [[1]](#1). Methods related to anti-analysis are below.
|
|
|
|
This and the [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md) behavior refine the ATT&CK [**Software Packing**](https://attack.mitre.org/techniques/T1045/) technique.
|
|
|
|
Methods
|
|
-------
|
|
* **Nested Packing**: the malware is packed by one packer, the result is packed, etc.
|
|
* **Standard Compression**: Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.
|
|
* **Standard Compression of Code**: Uses a standard algorithm to compress the opcode mnemonics.
|
|
* **Standard Compression of Data**: Uses a standard algorithm to compress strings and variables (executable file data).
|
|
* **Custom Compression**: Uses a custom algorithm to compress an executable file.
|
|
* **Custom Compression of Code**: Uses a custom algorithm to compress opcode mnemonics.
|
|
* **Custom Compression of Data**: Uses a custom algorithm to compress strings and variables (executable file data).
|
|
|
|
Malware Examples
|
|
----------------
|
|
|Name|Date|Description|
|
|
|-----------------------------|-----------|-----------------------------|
|
|
|
|
References
|
|
----------
|
|
<a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf
|
|
|
|
<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
|
|
|