I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on a daily basis? I would definitely like to get answer from AV industry experts.
What is the average time for defusing malware self-protection mechanisms?
malware;anti debugging;virus
Based on a couple of years of performing and teaching (Malware Bootcamp at University of Bonn, Germany) reverse engineering with focus on malware analysis, I mostly try to skip any easy stepping stones (malware capability of detecting analysis environments, be it VM, debugger, ...) to get to an unpacked state of the malware and then focus analysis on this in IDA alongside debugging it.Preparation of your own tools, e.g. setting up a reasonably proportioned (cores, HDD space, RAM) and concealed (removal of VM fragments) VM as explained by CrazyFrog can automagically carry a lot of load in this domain. I think I rarely spend more than minutes (i.e. native runtime of packer) to get to that unpacked state.For understanding those protections and detections, otherwise +1 for Peter Ferrie's reference. If you want to step through those in a debugger, you can use my defanged open source implementation of those.Newer detection approaches not covered by the above source frequently involve utilizing Windows Management Instrumentation (WMI). Often to achieve the same derivation of characteristics that can lead to the conclusion you are in an analysis environment.If there is protection in the sample itself, it's most often crypted strings or obfuscated API calls (Andromeda, Dridex, VM-Zeus come to mind), rarely execution-only decryption of code as seen in Fobber. In this case, it obviously becomes part of the analysis itself, or at least a pre-stage.