Obfuscated Files or Information: Binary Padding

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.[1] The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.[2] Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.[3]

ID: T1027.001
Sub-technique of:  T1027
Tactic: Defense Evasion
Platforms: Linux, Windows, macOS
Data Sources: File: File Content, File: File Metadata
Defense Bypassed: Anti-virus, Signature-based detection
CAPEC ID: CAPEC-572, CAPEC-655
Contributors: Martin Jirkal, ESET
Version: 1.1
Created: 05 February 2020
Last Modified: 17 September 2020

Procedure Examples

ID Name Description
G0050 APT32

APT32 includes garbage code to mislead anti-malware software and researchers.[1][4]

G0060 BRONZE BUTLER

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.[5][6]

S0244 Comnie

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.[7]

S0137 CORESHELL

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.[8]

S0082 Emissary

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.[9]

S0512 FatDuke

FatDuke has been packed with junk code and strings.[10]

S0182 FinFisher

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.[11][12]

G0047 Gamaredon Group

Gamaredon Group has obfuscated .NET executables by inserting junk code.[13]

S0477 Goopy

Goopy has had null characters padded in its malicious DLL payload.[14]

S0531 Grandoreiro

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.[15]

G0126 Higaisa

Higaisa performed padding with null bytes before calculating its hash.[16]

S0528 Javali

Javali can use large obfuscated libraries to hinder detection and analysis.[17]

S0236 Kwampirs

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.[18]

G0065 Leviathan

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.[19]

S0449 Maze

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.[20]

G0002 Moafee

Moafee has been known to employ binary padding.[21]

G0129 Mustang Panda

Mustang Panda has used junk code within their DLL files to hinder analysis.[22]

G0040 Patchwork

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.[23]

S0223 POWERSTATS

POWERSTATS has used useless code blocks to counter analysis.[24]

S0433 Rifdoor

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.[25]

S0370 SamSam

SamSam has used garbage code to pad some of its malware components.[26]

S0586 TAINTEDSCRIBE

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.[27]

S0117 XTunnel

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.[28]

S0248 yty

yty contains junk code in its binary, likely to confuse malware analysts.[29]

S0230 ZeroT

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.[30]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool. When executed, the resulting process from padded files may also exhibit other behavior characteristics of being used to conduct an intrusion such as system and network information Discovery or Lateral Movement, which could be used as event indicators that point to the source file.

References

  1. Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.
  2. Ishimaru, S.. (2017, April 13). Old Malware Tricks To Bypass Detection in the Age of Big Data. Retrieved May 30, 2019.
  3. VirusTotal. (n.d.). VirusTotal FAQ. Retrieved May 23, 2019.
  4. Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.
  5. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  6. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  7. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  8. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
  9. Falcone, R. and Miller-Osborn, J.. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  10. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  11. FinFisher. (n.d.). Retrieved December 20, 2017.
  12. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  13. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  14. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  15. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  1. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  2. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  3. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  4. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  5. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
  6. Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.
  7. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
  8. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  9. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.
  10. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  11. Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.
  12. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  13. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  14. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  15. Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.