Procedure examples

yty contains junk code in its binary, likely to confuse malware analysts.

Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.

WastedLocker contains junk code to increase its entropy and hide the actual code.

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.

SamSam has used garbage code to pad some of its malware components.

FatDuke has been packed with junk code and strings.

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.

NOOPLDR can insert junk code to obfuscate malicious payloads.

PureCrypter can insert junk code to avoid detection.

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.

LODEINFO has inserted junk code to obstruct code analysis.

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

ANELLDR can use junk code for payload obfuscation.

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.

POWERSTATS has used useless code blocks to counter analysis.

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Gelsemium can use junk code to hide functions and evade detection.