Practical Malware Analysis

Simple Ciphers

Simple encoding techniques have existed for thousands of years. While you might assume that the massive computing capacity of modern computers has made simple ciphers extinct, this is not the case. Simple encoding techniques are often used to disguise content so that it is not apparent that it is human-readable or to transform data into a different character set.

Simple ciphers are often disparaged for being unsophisticated, but they offer many advantages for malware, including the following:

• They are small enough to be used in space-constrained environments such as exploit shellcode.

• They are less obvious than more complex ciphers.

• They have low overhead and thus little impact on performance.

Malware authors who use a simple cipher ...