Prevalent Characteristics in Modern Malware
summary
Cataloged characteristics across 12 million PE samples using static-only analysis with simple detectors that flag detected/evidence/not-detected and run on a modest cluster — processed in ~10 days on 80 cores, parsed in 72 hours. Key findings: 37% of samples are packed, 74% have at least one high-entropy section, 61% expose only one executable section, 45% write files, 70% call GetProcAddress, 3.7% have empty import tables, 79% include SEH and only 15% show ASLR.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:16Disclaimer
- 1:52Brazil
- 2:11Demeans
- 3:04Motivation
- 6:05Sponsors
- 8:17Methodology
- 9:35Project Decision
- 29:57Untreated Techniques
- 31:21Obfuscation Techniques
- 31:50Functions of Interest
- 33:39Member of Sections
- 36:44Data Section
- 38:19Entry Point
- 41:42Silent Assignment
- 42:05Sexual Entropy
- 42:46Safe Execution Handler
related talks
33mBasic Malware Analysis for Incident Responders
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
45mFriendly fire: how security software messes up
28mAn Open Source Malware Classifier and Dataset
41mPredator Malware: Trust Broken At The Core
45m"Advanced Malware Threat: handling obfuscated code using..."
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
27mA Machine Learning approach for detecting a Malware