Mal-Flux: Rendering hidden code of packed binary executable. (March 2019)

• Record Type: Journal Article
• Authors: Lim, Charles; Suryadi, ; Ramli, Kalamullah; Kotualubun, Yohanes Syailendra
• Is Part Of: Digital investigation. Volume 28(2019)
• Page Start: 83
• Page End: 95
• Publication Date: 2019-03
• Subjects: Binary packer -- Memory analysis -- Malware -- Malicious code; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2019.01.004
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: A binary packer has commonly been used to protect the original code inside the binary executables from being detected as malicious code by anti-malware software. Various methods of unpacking packed binary executables have been extensively studied, and several unpacking approaches have been proposed. Some of these solutions depend on various assumptions, which may limit their effectiveness. Here, a new method of memory analysis technique, called Mal-Flux, is proposed to determine the end of unpacking routine to allow hidden code extraction from the packed binary executables. Our experiments show that our method provides better performance than previous works in extracting the hidden-code from the packed binary executables.