Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem

Abstract

An open research problem on malware analysis is how to statically distinguish between packed and non-packed executables. This has an impact on antivirus software and malware analysis systems, which may need to apply different heuristics or to resort to more costly code emulation solutions to deal with the presence of potential packing routines. It can also affect the results of many research studies in which the authors adopt algorithms that are specifically designed for packed or non-packed binaries. Therefore, a wrong answer to the question "is this executable packed?" can make the difference between malware evasion and detection. It has long been known that packing and entropy are strongly correlated, often leading to the wrong assumption that a low entropy score implies that an executable is NOT packed. Exceptions to this rule exist, but they have always been considered as oneoff cases, with a negligible impact on any large scale experiment. However, if such an assumption might have been acceptable in the past, our experiments show that this is not the case anymore as an increasing and remarkable number of packed malware samples implement proper schemes to keep their entropy low. In this paper, we empirically investigate and measure this problem by analyzing a dataset of 50K low-entropy Windows malware samples. Our tests show that, despite all samples have a low entropy value, over 30% of them adopt some form of runtime packing. We then extended our analysis beyond the pure entropy, by considering all static features that have been proposed so far to identify packed code. Again, our tests show that even a state of the art machine learning classifier is unable to conclude whether a low-entropy sample is packed or not by relying only on features extracted with static analysis.

Does Every Second Count? Time-based Evolution of Malware Behavior in Sandboxes

“…Clearly, such techniques also require a fully supervised training set composed by well tagged benign and malicious samples, so as to build and train the classifiers to categorize samples as malicious or benign. For this reason, we only selected samples that were identified to be malicious by at least 5 AV detection on VirusTotal-a rather conservative solution compared with the threshold used by other works [60]. Moreover, in contrast to many studies that selected benign samples by picking popular Windows applications or installation files, which in general are very well-known files and therefore easy to spot and whitelist by the security companies, we assembled our benign dataset from VirusTotal submissions.…”

An Experience in Enhancing Machine Learning Classifier Against Low-Entropy Packed Malwares

“…Table 4 shows the result of the error rate of dataset1. We also compared our results with the results of Mantovani et al [3]. Parameter w indicates the vectors of all features, and parameter w' indicates the vectors of all features except the entropy-related features.…”

“…We used two datasets in our experiments: one was acquired from [3], and the other was collected from VirusTotal; these are termed as dataset1 and dataset2, respectively. The samples collected from VirusTotal are all ransomware, and the collecting period is between May 29 and June 30, 2020.…”

“…For dataset1, we adopted the labels used by Mantovani et al [3]. The training set of dataset1 comprises 7,500 packed and unpacked samples each.…”

“…Table 2 shows the best detection result of the error rate of the machine learning model with entropy-related features in the research of Mantovani et al [3]. They attempted to determine the effect of low-entropy packed samples on machine learning.…”