File Packing from the Malware Perspective: Techniques, Analysis Approaches, and Directions for Enhancements

Abstract

With the growing sophistication of malware, the need to devise improved malware detection schemes is crucial. The packing of executable files, which is one of the most common techniques for code protection, has been repurposed for code obfuscation by malware authors as a means of evading malware detectors (mainly static analysis-based detectors). This paper provides statistics on the use of packers based on an extensive analysis of 24,000 PE files (both malicious and benign files) for the past 10 years, which allowed us to observe trends in packing use during that time and showed that packing is still widely used in malware. This paper then surveys 23 methods proposed in academic research for the detection and classification of packed portable executable (PE) files and highlights various trends in malware packing. The paper highlights the differences between the methods and their abilities to detect and identify various aspects of packing. A taxonomy is presented, classifying the methods as static, dynamic, and hybrid analysis-based methods. The paper also sheds light on the increasing role of machine learning methods in the development of modern packing detection methods. We analyzed and mapped the different packing methods and identified which of them can be countered by the detection methods surveyed in this paper.

A Compact Multi-Step Framework for Packing Identification in Portable Executable Files for Malware Analysis

“…Determining whether a binary has been packed is a critical preliminary step in the process of malware detection [3]. Research conducted by Osaghae indicates that over 80% of current malware samples utilize packing [11], highlighting the significance of addressing this issue through both detection and unpacking.…”

“…However, the challenge of anti-analysis extends beyond merely prolonging the malware's operational life. When researchers analyze packed malware samples, they often extract features introduced by the packer rather than the original program [3]. This discrepancy can lead to potential mismatches between analysis results and the actual malicious behavior, particularly as packed malware can detect and avoid dynamic analysis.…”

A Survey and Evaluation of Android-Based Malware Evasion Techniques and Detection Frameworks

“…Code transformation techniques hinder disassembly tools [105] and evade commercial anti-malware [37,106,107]. These techniques obfuscate existing malware samples to generate unseen malicious files.…”

Introducing the CYSAS-S3 Dataset for Operationalizing a Mission-Oriented Cyber Situational Awareness

“…Although the section above analysed the state-of-the-art of network traffic generators, none of those has a security-oriented approach since there was no distinction between the inference of neutral (benign) and malicious traffic. The particular traffic generation requirements for this purpose, among others, are discussed in [14], where three types of workloads are distinguished: (1) workloads that do not contain attacks (Pure benign); (2) workloads that contain only attacks (pure malicious); (3) workloads that are a mixture of pure benign and pure malicious workloads (Mixed) [54]. These types of workloads may present two different forms: executable and trace.…”