Obfuscated Files or Information: Binary Padding

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.^[4]

APT32 includes garbage code to mislead anti-malware software and researchers.^[1][5]

Bisonal has appended random binary data to the end of itself to generate a large binary.^[6]

Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.^[7]

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.^[8][9]

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.^[10]

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.^[11]

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.^[12]

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.^[13]

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.^[14]

Emotet inflates malicious files and malware as an evasion technique.^[15]

FatDuke has been packed with junk code and strings.^[16]

FIN7 has used random junk code to obfuscate malware code.^[17]

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.^[18][19]

Gamaredon Group has obfuscated .NET executables by inserting junk code.^[20]

Gelsemium can use junk code to hide functions and evade detection.^[21]

Goopy has had null characters padded in its malicious DLL payload.^[22]

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.^[23]

GrimAgent has the ability to add bytes to change the file hash.^[24]

Higaisa performed padding with null bytes before calculating its hash.^[25]

Javali can use large obfuscated libraries to hinder detection and analysis.^[26]

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.^[27]

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.^[28]

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.^[29]

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.^[30]

Moafee has been known to employ binary padding.^[31]

Mustang Panda has used junk code within their DLL files to hinder analysis.^[32]

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[33]

POWERSTATS has used useless code blocks to counter analysis.^[34]

QakBot can use large file sizes to evade detection.^[35][36]

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.^[37]

SamSam has used garbage code to pad some of its malware components.^[38]

Snip3 can obfuscate strings using junk Chinese characters.^[39]

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.^[40]

WastedLocker contains junk code to increase its entropy and hide the actual code.^[41]

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.^[42]

yty contains junk code in its binary, likely to confuse malware analysts.^[43]

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.^[44]