Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]
No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.[1]
The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
| ID | Name | Description |
|---|---|---|
| G0050 | APT32 |
APT32 includes garbage code to mislead anti-malware software and researchers.[3][4] |
| S0137 | CORESHELL |
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.[5] |
| S0512 | FatDuke | |
| G0046 | FIN7 |
FIN7 has used random junk code to obfuscate malware code.[7] |
| S0182 | FinFisher |
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.[8][9] |
| G0047 | Gamaredon Group |
Gamaredon Group has obfuscated .NET executables by inserting junk code.[10] |
| S0666 | Gelsemium |
Gelsemium can use junk code to hide functions and evade detection.[11] |
| S0477 | Goopy |
Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.[12] |
| G0094 | Kimsuky |
Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.[13] |
| S0449 | Maze |
Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.[14] |
| G0129 | Mustang Panda |
Mustang Panda has used junk code within their DLL files to hinder analysis.[15][16] |
| S0453 | Pony |
Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.[17] |
| S0223 | POWERSTATS |
POWERSTATS has used useless code blocks to counter analysis.[18] |
| S0370 | SamSam |
SamSam has used garbage code to pad some of its malware components.[19] |
| S1183 | StrelaStealer |
StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.[20] |
| S0612 | WastedLocker |
WastedLocker contains junk code to increase its entropy and hide the actual code.[21] |
| S0117 | XTunnel |
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.[22] |
| S0248 | yty |
yty contains junk code in its binary, likely to confuse malware analysts.[23] |
| S0230 | ZeroT |
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.[24] |
| ID | Mitigation | Description |
|---|---|---|
| M1049 | Antivirus/Antimalware |
Anti-virus can be used to automatically detect and quarantine suspicious files. Behavior-based detections, rather than reliance on static code analysis, may help to identify malicious files that rely heavily on junk code.[1] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0322 | Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns | AN0913 |
Detects the presence of executables with high NOP padding, unusually large binary size for their function, and follow-on execution or memory injection from such files, especially when originating from temp or user-space paths. |
| AN0914 |
Detects ELF binaries written to disk that demonstrate anomalous file size or entropy, quickly followed by execution or memory region writes into remote processes (e.g., using ptrace). |
||
| AN0915 |
Identifies Mach-O binaries dropped into temporary directories with abnormally high binary size or padding patterns, followed by privilege escalation, |