Obfuscated Files or Information: Binary Padding

Akira has used binary padding to obfuscate payloads.^[4]

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.^[5]

Bisonal has appended random binary data to the end of itself to generate a large binary.^[6]

Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.^[7]

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.^[8][9]

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.^[10]

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.^[11]

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.^[12]

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.^[13]

Emotet inflates malicious files and malware as an evasion technique.^[14]

Goopy has had null characters padded in its malicious DLL payload.^[15]

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.^[16]

GrimAgent has the ability to add bytes to change the file hash.^[17]

Higaisa performed padding with null bytes before calculating its hash.^[18]

Javali can use large obfuscated libraries to hinder detection and analysis.^[19]

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.^[20]

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.^[21]

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.^[22]

LightSpy's configuration file is appended to the end of the binary. For example, the last 0x1d0 bytes of one sample is an AES encrypted configuration file with a static key of 3e2717e8b3873b29.^[23]

Moafee has been known to employ binary padding.^[24]

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[25]

QakBot can use large file sizes to evade detection.^[26][27]

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.^[28]

Snip3 can obfuscate strings using junk Chinese characters.^[29]

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.^[30]