Next-Generation of Exploit Kit Detection By Building Simulated Obfuscators
summary
Builds reconstructed obfuscators for six EK families (Angler, Nuclear, Rig, Magnitude, Neutrino, SweetOrange) from ~20,000 malware samples, using JavaScript token normalization, hierarchical clustering and manual template/engine recovery; 7,800 Angular samples collapse to 63 normalized scripts, generated obfuscators boost sample diversity about 3×, and similarity thresholds around 0.4–0.5 for versions and 0.78–0.85 for variants let automated clustering map evolution; delivers a working site (jar.com) and an open-sourced generator that measurably raises similarity-based detection rates.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:19Welcome
- 1:34Background
- 2:16Website
- 3:12Obstacle Page
- 3:38Previous research
- 4:10Scheduling application
- 4:44Reverse engineering
- 5:51In the real world
- 6:19Data complicity
- 6:51Highlevel picture
- 7:39Normalization
- 9:04Rotation
- 9:32Color Structure
- 10:51Similarity
- 12:15Stream Crossing
- 13:20Hierarchical Crossmark
- 13:31Passive Threshold
- 15:27Analysis
- 17:41Life Cycle
- 18:23New Version
- 18:59Angular is Poor Kid
- 19:55Application Engine Change
- 21:35Conclusion
- 22:09Outro
related talks
47mJavaScript Obfuscation: It’s All About the P a c k e r s
45m"Advanced Malware Threat: handling obfuscated code using..."
20mAutomated Exploit Generation for Node.js Packages
26mWhen Models Write Malware: Defending Against On-demand Exploits
49mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2)
37mAutomatic Extraction of Indicators of Compromise for Web App.
05mQuick Look: Exploit Kits and Malware ROI
44mUsing Pester & ScriptAnalyzer for Detecting Obfuscated...