On Fingerprinting of Public Malware Analysis Services. (7th December 2019)

• Record Type: Journal Article
• Authors: Botas, Alvaro; Rodríguez, Ricardo J; Matellan, Vicente; Garcia, Juan F; Trobajo, M T; Carriegos, Miguel V
• Is Part Of: Logic journal of the IGPL. Volume 28:Number 4(2020)
• Page Start: 473
• Page End: 486
• Publication Date: 2019-12-07
• Subjects: Malware analysis service -- analysis-aware malware -- sandbox -- characterization -- unlikeability; Logic, Symbolic and mathematical -- Periodicals; 511.3
• DOI: 10.1093/jigpal/jzz050
• Languages: English
• ISSNs: 1367-0751

Abstract

Abstract: Automatic public malware analysis services (PMAS, e.g. VirusTotal, Jotti or ClamAV, to name a few) provide controlled, isolated and virtual environments to analyse malicious software ( malware ) samples. Unfortunately, malware is currently incorporating techniques to recognize execution onto a virtual or sandbox environment; when an analysis environment is detected, malware behaves as a benign application or even shows no activity. In this work, we present an empirical study and characterization of automatic PMAS, considering 26 different services. We also show a set of features that allow to easily fingerprint these services as analysis environments; the lower the unlikeability of these features, the easier for us (and thus for malware) to fingerprint the analysis service they belong to. Finally, we propose a method for these analysis services to counter or at least mitigate our proposal.