0

How can these pe attributes be used to identify malware.

I was going though a paper link at page 10 he mentioned.

"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary indicator due to the significant detection rate with a low false positive rate"

  • Please share your hypothesis and reasoning, as well as the relevant research you have done. – julian Mar 5 at 10:32
  • 1
    let me google this for you docs.microsoft.com/en-us/windows/desktop/debug/pe-format – blabb Mar 5 at 10:47
  • Can you help with why does some malware has this flag set? – Ajay Kumar K K Mar 5 at 10:52
  • that paper describes a statistical analysis of differences between two sets of binaries the flags are set by linker and i don't think a define or switch exist to set them while compiling so i am not sure about the reasoning behind that assertion – blabb Mar 5 at 11:48
  • I don't understand the hostility in the responses here. – Johann Aydinbas Mar 5 at 16:00
1

I actually think this is a good and valid question.

And I think the answer here is - it is because it is. What I mean is that they analyzed a bunch of samples, separated them into malicious/benign, and then found out that when these flags are set it's almost always malware, so it makes a good indicator because they observed it to be a good one.

I can't think of a logical reason. It's probably a field nobody sets on purpose in legit software. Maybe some packers or whatever sets the field in order to alter the files' checksum? Google says those flags are obsolete so setting them should not have any effect at all, but it would change a file's checksum.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.