Distribution of malware obfuscation types

Question

There are several statistics and numbers out there of current malware families and their distributions.

However, I'am looking for statistics which shows the distribution of malware differed by their obfuscation types, i.e. current distribution of encrypted, oligomorphic, polymorphic, metamorphic in the wild.

So far I mainly focused reports lastly published by AV vendors, but couldn't find anything useful.

Answer 1

Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a polymorphic technique.

[A] Toward Generic Unpacking Techniques for Malware Analysis with Quantification of Code Revelation - 2009

Perhaps a own analysis could help with a bigger set of malware samples. The following "evalualtion" of me was done with the public available kaggle malware set. Even if it is not a clear classifcation of the used obfuscation technique of the families, hopefully this approach could help you out or point you to the right direction. I did the classifaction with the help of different statistics like entropy value, chi-square distribution and a pi approximation.

NORM    COMPR   ENCR
-----------------------------------------
581     691     260      Ramnit      
2475    3       0        Lollipop 
0       10      2932     Kelihos_ver3    
6       51      418      Vundo   
3       22      18       Simda  
233     260     258      Tracur   
387     4       7        Kelihos_ver1 
524     667     37       Obfuscator  
779     219     15       Gatak  

NORM  = non-obfuscated characteristics (i.e. not compressed/encrypted)
COMPR = compressed or packed characteristics
ENCR  = encrypted characteristics