Packer identification method based on byte sequences

Abstract

Summary With the growing number of malware, malware analysis technologies need to be advanced continuously. Malware authors use various packing techniques to hide their code from malware detection tools and techniques. The packing techniques are generally used to compress and encrypt executable code in executable files, and the unpacking code is usually embedded in the executable files. Therefore, packed executable files can be executed by itself, and the information associated with packing can be used to analyze and detect malware. Since different packing tools will generate different packed executable files, packing tools can be identified by analyzing packed executable files, and packer identification can reduce malware‐analyzing overheads, and the executable files can even be unpacked. However, most previous studies focused on packing detection using signatures of unpacking code, and these approaches can be avoided by placing unpacking code in other locations or by distributing unpacking code in multiple locations. In this paper, we propose a new packer identification method by analyzing only code sections to extract features of malware generated by different packing tools. Experimental results show that our approach can identify different packing tools with the accuracy of 91.6% on average. Considering packer identification is the harder problem than packing detection, we argue that our approach can contribute to reducing overheads of malware analysis.

Minimized feature overhead malware detection machine learning model employing MRMR‐based ranking

“…The smoothing technique used in this work is moving-mean. 39 In the moving mean technique, the data is being replaced by the average value of the neighboring data values, as expressed in Equation (2).…”

A Novel Method for Detecting Future Generations of Targeted and Metamorphic Malware Based on Genetic Algorithm

“…A drastic change in the entropy of machine code created by standard compilers indicates that the file has been packed. Many types of packers such as UPX 2 , FSG, Yoda's 3 , ExeStealth 4 , PETite 5 , ASPack 6 , UPack, and VMProtect 7 can be detected by looking for a unique sequence of byte codes [8], though the unpacking patterns and decryption keys are not detectable using this method. The complexity and ambiguity of malware activities prompts analysts towards dynamically monitoring and analyzing malware's behavior in order to discover the true nature of obfuscated files.…”

“…The latter method has increased challenges as it needs to reverse the malware binary. There are also some obstacles regarding reversing obfuscated and packed malware, including packer identification and decrypting ciphered sections [8], normalizing metamorphic codes [13], and executing time-limited malware -malware that only runs on a specific point or period of time. However, its efficiency was proven compared to other methods, and the amount of data required for creating the corresponding images is smaller than the former method.…”

Cognitive and innovative computation paradigms for big data and cloud computing applications

“…Choi, and E.G. Im proposes a new packer identification method that uses two types of statistical features. These features are generated using encrypted data and feature from byte frequency distributions.…”