Obfuscation is the process of hiding or masking meaningful information.
In binaries, obfuscation makes it harder to understand the program.
Here is how a typical binary would look like.
As you notice, you still see few meaningful words which can be used to construct the functions of a malware.
But when the same binary is obfuscated, it would look something like this.
And we now notice.
It is impossible to understand what has been written.
Why do malware authors want to obfuscate their malware file?
The main purpose is to make the detection and analysis of the malware difficult.
Obfuscation also delays the process of malware analysis, thereby giving the malware author more time to do
the damage or spread to more machines before being stopped.
Sometimes the whole of the file will be obfuscated and in some cases only a part of the file like
dot text section, can be obfuscated.
There are different methods used by attackers to obfuscate the malware.
Few of them are discussed here.
First method is Packers, packer is a software used to compress the binary file.
The file unpacks itself when a program is executed.
One should understand that Packers were not developed for malicious purpose.
They were used to make a executable file size smaller.
Packers are used by malware authors to avoid detection and delay the analysis.
Packers are also called as runtime packers or self extracting archives.
In the image, you would see how a binary file with a PE header and a section undergoes packing and the
packed file will have a brand new PE header and a decompression stub which holds the instructions to unpack
the malware while executing.
Few of the popular packers include UPX, stands for Ultimate Packer for executables exe stealth.
PESpin.
Obsidium and etc..
The next technique is polymorphic or metamorphic Malwares, most malwares use encryption to avoid being
detected by antivirus scanning.
The instructions to decrypt the malware will be in the decrypter.
In polymorphic, the malware constantly changes its identifiable features to evade detection.
However, it keeps changing only one part of the malware, for example, it could be a decrypter.
However, in metamorphic malware, the malware completely rewrites the code, as you see in the image
Both the malware code, and the decrypter keeps changing.
other name for such malware is called Self Modifying Malwares.
Next method of obfuscating malwares is dead code insertion.
This is a simple technique of adding a few useless instructions in the program to change its appearance,
but the behavior will remain the same.
Here it shows how a dead or a non-functional code can be inserted, it might look very obvious now as
I have highlighted the lines, but imagine understanding and identifying these lines in hundreds of lines
of code.
Next, we have a technique called subroutine reordering a subroutine is a part of a program that does a specific
part.
It is sometimes referred to as function.
In subroutine reordering method, the malware author just changes the order in which the functions are
written, thereby changing the file hash.
Consider an example where a program has seven subroutines.
In the second version, the malware authors just changes the order of the subroutine, thereby having multiple
variants of the same malware.
Consider an example where a program has seven subroutines.
In the further versions, the malware order just keeps changing the order of the subroutine, thereby
having multiple variants of the same malware.
Another method is called instruction substitution.
This method changes an original code by replacing some instructions with other equivalent ones.
In programming, one result can be achieved by various logic.
In the instructions substitution method, the malware author achieve the same malicious task by changing
the logic of the code, thereby changing the file hash.
Few of the other popular obfuscation techniques include exclusive or method, simply referred to as
XOR.
Base64 encoding and Rot13, it stands for rotate by 13.