Encoded Executable File Detection Technique via Executable File Header Analysis

摘要: Recently, the attack trends have been changed from fast and widespread malware propagation attacks to more sophisticated “targeted” such as spy/adware, password stealers, ransom-ware, botenets etc. are tried via automated malwares. In this situation, is most powerful weapon for attackers. So, attackers do not want their malwares be reviled by anti-virus analyzer. order conceal malware, programmers getting utilize anti reverse engineering techniques code changing packing, encoding encryption techniques. If packed or encrypted, then it very difficult analyze. Therefore, prevent harmful effects of generate signatures detection, encrypted executable codes must initially unpacked. The first step unpacking detect files. paper, a file detection technique based on PE Header Analysis proposed. many cases, pack unpack codes, files unusual attributes in headers. these characteristics utilized A Characteristic Vector (CV) that consists eight elements defined, Euclidean distance (ED) CV calculated. EDs calculated represent base threshold