1

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.

However, is there a similar technique that changes the order of the malware behaviour, which belongs to the same family or variants?

An example with Malware 1 and Malware 2 from the same malware family X:

  • Malware 1 will connect to the internet and then access the registry
  • Malware 2 will do the same thing but with a different order

If it does exist is their a known name for this kind of obfuscation? Are there any papers, which refer to such a obfuscation technique?

2 Answers 2

1

This would likely fall into the category of "advanced metamorphic malware", though I'm not aware of any real-world malware that automatically changes the order of high-level run-time functionality from variant to variant.

An exception would be malware that uses multiple threads for various pieces of functionality, where the OS scheduler would "randomly" choose the order in which cross-thread functional operations occur... but I don't think that's what you're asking for.

Paging @peter-ferrie, who might have something more substantial to offer here...

1
  • 1
    There have been viruses which did that. Hybris is perhaps the most famous example. It relied on a plug-in framework, and the order in which the plug-ins were acquired changed the behavior of the resulting variant. We didn't require a name for that.There were viruses going back to DOS days, such as BadBoy, which changed the order of their subroutines so affect the appearance of the layout, but the call flow remained the same. We call those "block-swapping" viruses. Jul 29, 2016 at 16:02
1

The only comparable technique which I found was called Code Transposition, where you have to distunghish between two types: The first one is based on conditional jumps, the second one is based on independent instructions. I'm not clearly sure if you are looking for a technique on a higher, more "semantic" level.

[...] the second method creates new generations by choosing and reordering the independent instructions that have no impact on one another. Because it is a complex problem to find the independent instructions, this method is hard to implement, but can make the cost of detection high. [2]

Sources are:

[1] Christodorescu, M., & Jha, S. (2006). 
Static analysis of executables to detect malicious patterns.   
Wisconsin Univ-Madison Dept of Computer Sciences.

[2] You, I., & Yim, K. (2010, November). 
Malware Obfuscation Techniques: A Brief Survey. 
In BWCCA (pp. 297-300).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.