Impeding Malware Analysis Using Conditional Code Obfuscation

摘要: Malware programs that incorporate trigger-based behavior initiate malicious activities based on conditions satisfied only by specific inputs. State-of-the-art malware analyzers discover code guarded triggers via multiple path exploration, symbolic execution, or forced conditional all without knowing the trigger We present a obfuscation technique automatically conceals from these analyzers. Our transforms program encrypting is conditionally dependent an input value with key derived and then removing program. have implemented compiler-level tool takes source generates obfuscated binary. Experiments various existing samples show our can hide significant portion of code. provide insight into strengths, weaknesses, possible ways to strengthen current analysis approaches in order defeat this technique.