One Packer to Rule Them All
summary
Empirical test of anti-virus static, emulation and runtime stages shows a custom packer called Becker + two novel techniques—in-line packer and resource packer—that use reflective DLL injection and template borrowing to hide sections and imports. Result: 64-bit malware samples become undetected by all tested AVs after resource packing; 32-bit evasion succeeds widely but three AV engines (including Microsoft, Kaspersky, AVG) still flag some samples. Paper gives concrete checks (timing, SMB, filesystem, instrumentation) and in-process hooks used to evade emulation and runtime heuristics.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:26Agenda
- 0:50About Us
- 1:04What is packing
- 1:40Why is packing useful
- 2:21Portable executable file format
- 3:10Program example
- 6:17Reflective DLL Injection
- 7:22Second Main Challenge
- 7:48Section Tables
- 8:17Pack Packing
- 11:18Pack Packing Solution
- 13:23Resource Packer
- 17:50Interaction with Network
- 18:15Interaction with Fault System
- 18:55Instrumentation
- 19:27Results
- 21:30DT Hooking
- 22:11Inline Hooking
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
55mHiding PIN's Artifacts to Defeat Evasive Malware
28mAVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
47mJavaScript Obfuscation: It’s All About the P a c k e r s
41mAPTs Way: Evading Your EBNIDS
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter