Non normalizable functions: A new method to generate metamorphic malware
To successfully identify the metamorphic viruses oriented from the same base, anti virus software has adopted the code normalization technique to transform the variations to a more uniform signature representation. Current code normalization technique focuses on the simplification of the arithmetical or logical operators. In this paper, we introduce a new technique of generating metamorphic viruses by embedding complicated manipulation functions that cannot be normalized into the malicious executables. Using encryption/decryption functions as an example, we present this evasion strategy that malware writers could employ in the future. We demonstrate the strategy's effectiveness in evading detection by current anti virus technologies. We also discuss the potential mitigation mechanisms.
2011 MILCOM 2011 Military Communications Conference