Hands-On Artificial Intelligence for Cybersecurity

Anti-analysis tricks

The countermeasures usually adopted by malware developers, which prevent malware analysis or make it more difficult, rely on encryption of the payloads, the use of packers, of downloaders, and others.

These tricks are normally detectable with dynamic malware analysis; however, even dynamic malware analysis suffers from limitations related to the use of virtual machines—for example—whose presence can be easily detected by malware by exploiting some execution tricks, as follows:

• Execution of instructions that expect a default behavior: The malware can calculate the time that elapses in the execution of certain operations, and if these were performed more slowly than expected, it can deduce consequently that the execution ...