skip to main content
10.1145/2746194.2746213acmotherconferencesArticle/Chapter ViewAbstractPublication PageshotsosConference Proceedingsconference-collections
poster

Packer classifier based on PE header information

Published: 21 April 2015 Publication History

Abstract

Run-time binary packers are used in malware manufacturing to obfuscate the contents of the executable files. Such packing has proved an obstacle for antivirus software that relies on signatures, as the binary contents of packed malware often bears no resemblance to the original code on which the signature was generated. A naive approach, then, is to first attempt to unpack the malware before applying a signature. Unfortunately, malware authors make use of automated tools that drastically reduce the cost of constructing new packers, and as a result, attackers routinely use previously unseen packer when releasing new malware.
As a first step towards addressing this problem, we seek to build a binary program classifier that can differentiate packers and identify new packers as they emerge. We hypothesize that programs generated from the same packer share many common attributes (e.g., PE header fields) and that these may be used for packer identification. Preliminary work shows that for some packers, we may be able to build effective classifiers. This is only the first step in a line of research that seeks to identify new packers, automate their unpacking, and ultimately track new versions of malware as they emerge.

References

[1]
Peid. http://www.peid.info.
[2]
Vmprotect. http://vmpsoft.com.
[3]
T. Koivunen. Sigbuster. http://www.teamfurry.com.
[4]
L. Martignoni, M. Christodorescu, and S. Jha. Omniunpack: Fast, generic, and safe unpacking of malware. In Computer Security Applications Conference, 2007.
[5]
J. Oberheide, M. Bailey, and F. Jahanian. Polypack: An automated online packing service for optimal antivirus evasion. In Proceedings of the 3rd USENIX conference on Offensive technologies, 2009.

Cited By

View all
  • (2024)Identifying Malware Packers through Multilayer Feature Engineering in Static AnalysisInformation10.3390/info1502010215:2(102)Online publication date: 9-Feb-2024
  • (2023)A survey on run-time packers and mitigation techniquesInternational Journal of Information Security10.1007/s10207-023-00759-y23:2(887-913)Online publication date: 1-Nov-2023
  • (2021)2-SPIFF: a 2-stage packer identification method based on function call graph and file attributesApplied Intelligence10.1007/s10489-021-02347-wOnline publication date: 21-Apr-2021
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences
HotSoS '15: Proceedings of the 2015 Symposium and Bootcamp on the Science of Security
April 2015
170 pages
ISBN:9781450333764
DOI:10.1145/2746194
  • General Chair:
  • David Nicol
Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the Owner/Author.

Sponsors

  • US Army Research Office: US Army Research Office
  • NSF: National Science Foundation
  • University of Illinois at Urbana-Champaign
  • National Security Agency: National Security Agency

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 21 April 2015

Check for updates

Qualifiers

  • Poster

Funding Sources

  • National Science Foundation

Conference

HotSoS '15
Sponsor:
  • US Army Research Office
  • NSF
  • National Security Agency

Acceptance Rates

HotSoS '15 Paper Acceptance Rate 13 of 22 submissions, 59%;
Overall Acceptance Rate 34 of 60 submissions, 57%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)4
  • Downloads (Last 6 weeks)0
Reflects downloads up to 23 Sep 2024

Other Metrics

Citations

Cited By

View all
  • (2024)Identifying Malware Packers through Multilayer Feature Engineering in Static AnalysisInformation10.3390/info1502010215:2(102)Online publication date: 9-Feb-2024
  • (2023)A survey on run-time packers and mitigation techniquesInternational Journal of Information Security10.1007/s10207-023-00759-y23:2(887-913)Online publication date: 1-Nov-2023
  • (2021)2-SPIFF: a 2-stage packer identification method based on function call graph and file attributesApplied Intelligence10.1007/s10489-021-02347-wOnline publication date: 21-Apr-2021
  • (2018)Packer identification method based on byte sequencesConcurrency and Computation: Practice and Experience10.1002/cpe.508232:8Online publication date: 18-Nov-2018

View Options

Get Access

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media