Obfuscation by changing the order of a malware behaviour

Question

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.

However, is there a similar technique that changes the order of the malware behaviour, which belongs to the same family or variants?

An example with Malware 1 and Malware 2 from the same malware family X:

• Malware 1 will connect to the internet and then access the registry
• Malware 2 will do the same thing but with a different order

If it does exist is their a known name for this kind of obfuscation? Are there any papers, which refer to such a obfuscation technique?

Answer 1

This would likely fall into the category of "advanced metamorphic malware", though I'm not aware of any real-world malware that automatically changes the order of high-level run-time functionality from variant to variant.

An exception would be malware that uses multiple threads for various pieces of functionality, where the OS scheduler would "randomly" choose the order in which cross-thread functional operations occur... but I don't think that's what you're asking for.

Paging @peter-ferrie, who might have something more substantial to offer here...

Answer 2

The only comparable technique which I found was called Code Transposition, where you have to distunghish between two types: The first one is based on conditional jumps, the second one is based on independent instructions. I'm not clearly sure if you are looking for a technique on a higher, more "semantic" level.

[...] the second method creates new generations by choosing and reordering the independent instructions that have no impact on one another. Because it is a complex problem to find the independent instructions, this method is hard to implement, but can make the cost of detection high. [2]

Sources are:

[1] Christodorescu, M., & Jha, S. (2006). 
Static analysis of executables to detect malicious patterns.   
Wisconsin Univ-Madison Dept of Computer Sciences.

[2] You, I., & Yim, K. (2010, November). 
Malware Obfuscation Techniques: A Brief Survey. 
In BWCCA (pp. 297-300).