Large-Scale Analysis on Anti-Analysis Techniques in Real-World Malware

Abstract

To dynamically identify malicious behaviors of millions of Windows malware, anti-virus vendors have widely been using sandbox-based analyzers. However, the sandbox-based analysis has a critical limitation that anti-analysis techniques (i.e., Anti-sandbox and Anti-VM techniques) can easily detect analyzers and evade from being analyzed. In this work, we study on anti-analysis techniques used in real-world malware. First off, to measure how many Windows malware exhibits anti-analysis techniques, we collect anti-analysis techniques used in malware. We, then, design and implement an automated system, named EvDetector, that detects malware which employ anti-analysis techniques. EvDetector finds if malware uses an anti-analysis technique and monitors whether the malware changes its execution paths based on the result of the anti-analysis technique. By using EvDetector, we analyzed 763,985 real-world malware that emerged from 2017 to 2020. Our evaluation results show that 16.21% of malware use antianalysis techniques on average. Also, we check the effectiveness of the analysis result by comparing EvDetector and static analysis. EvDetector analyzes up to 49.88% of malware detected by static analysis did not use anti-analysis techniques. In addition, we analyze that only up to 3.75% of the packed malware used anti-analysis techniques. Finally, we analyze the evasive malware trend through familial analysis and behavioral analysis. Our work implies that the research community needs to put more effort on defeating such anti-analysis techniques to automatically analyze emerging malware and respond with them.

Defeating Evasive Malware with Peekaboo: Extracting Authentic Malware Behavior with Dynamic Binary Instrumentation

“…In line with recent research detailing the success of DBI tools in countering malware evasive behavior 19,23,[32][33][34] Pin allocates on the heap. Pinvm.dll makes a copy of the malware executable along with the injected Peekaboo instrumentation code in the code cache 70 .…”

“…However, there is an existing body of research that have developed methods to defeat the anti-instrumentation probes performed by malware 19,21,30,33,34 . In contrast to the 80% and 99% of malware samples that used anti-analysis techniques, identi ed above, Kim, et al 32 and Polino, et al 33 found that approximately 16% and 15% of malware used anti-instrumentation techniques. This indicates the evasive techniques used by malware authors are not focused on DBI but rather virtualization, debuggers, and sandboxes.…”

“…NtGlobalFlag is a variable in the Process Execution Block (PEB) that is set to 0x70 when a debugger is attached 32 . A 64-bit and 32-bit PEB is created by the Windows 10 64-bit VM when running the 32-bit malware, where the NtGlobalFlag is set to 0x70 for the 64-bit PEB.…”

“…These API and System calls are used by benign software for legitimate purposes but are also exploited by malware. Further, Central Processing Unit (CPU) identi cation, detecting differences in the memory address space as well as differences in operation timings can be used to identify debuggers, sandboxes and DBI 12,19,24,25,32,33 .…”

A Kullback-Liebler divergence-based representation algorithm for malware detection

“…Several studies ( Shijo & Salim, 2015 ; Darshan & Jaidhar, 2019 ; Yoo et al, 2021 ) stated that dynamic analysis offers more reliable detection capabilities than static analysis. On the other hand, malware authors use immediate evasion techniques as a defense against dynamic analysis ( Kim et al, 2022 ). By analyzing 45,375 malware samples, Galloro et al (2022) concluded that the use of evasion mechanisms has increased among malware by 12% over the past ten years, and 88% of malicious software can perform new evasion behaviors rather than the older ones.…”