fengjixuchui / anti.analysis

Malware Analysis, Anti-Analysis, and Anti-Anti-Analysis

Anti.Analysis

This repository contains additional material for the Paper Analysis, Anti-Analysis, Anti-Anti-Analysis: An Overview of the Evasive Malware Scenario.

Authors

This work was developed by Marcus Botacin and Vitor Falcão da Rocha, under supervision of Prof. Dr. Paulo Lício de Geus and Prof. Dr. André Ricardo Abed Grégio.

Goals

• Provide implementations for known anti-analysis tricks.
• Evaluate these detectors in distinct usage scenarios.
• Analyze distinct datasets regarding their anti-analysis tricks.

Whitepaper

The Whitepaper directory contains additional material for the published paper, including additional discussion, graphs, and so on.

Tricks

The Tricks directory contains some assembly implementations of the mentioned tricks. These can be used for validating our detectors.

Detectors

The Detectors directory contains python implementation for the tricks detectors.

Data and Results

The Data directory describes names, hashes, and tricks detected for each binary/used dataset.

Misc

The Misc directory contains some code and other stuff used for additional tests.

Publication

The paper Analysis, Anti-Analysis, Anti-Anti-Analysis: An Overview of the Evasive Malware Scenario will appear in Proceedings of SBSEG 2017.