Sub-technique of T1027 Obfuscated Files or Information.View on attack.mitre.org
Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.
No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.
The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Rules on DetectionCode tagged with T1027.016.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT-C-36 | APT-C-36 has used junk characters to obfuscate malicious scripts. |
| GroupAPT32 | APT32 includes garbage code to mislead anti-malware software and researchers. |
| GroupFIN7 | FIN7 has used random junk code to obfuscate malware code. |
| GroupGamaredon Group | Gamaredon Group has obfuscated .NET executables by inserting junk code. |
| GroupKimsuky | Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection. |
| GroupMustang Panda | Mustang Panda has used junk code within their DLL files to hinder analysis. |
| Used by | Procedure example |
|---|---|
| MalwareANELLDR | ANELLDR can use junk code for payload obfuscation. |
| MalwareCORESHELL | CORESHELL contains unused machine instructions in a likely attempt to hinder analysis. |
| MalwareFatDuke | FatDuke has been packed with junk code and strings. |
| MalwareFinFisher | FinFisher contains junk code in its functions in an effort to confuse disassembly programs. |
| MalwareGelsemium | Gelsemium can use junk code to hide functions and evade detection. |
| MalwareGoopy | Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis. |
| MalwareLODEINFO | LODEINFO has inserted junk code to obstruct code analysis. |
| MalwareMaze | Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
