Obfuscated Malware

Let me first discuss the dictionary meaning of obfuscated then it would be easier to relate and get the meaning of obfuscated malware.

Obsfucation: The action of making something obscure, unclear, or unintelligible.

Obsfucated malware means when authors make it's detection difficult. It's underlying functionality is not affected but it's strings are rendered unreadable.

Commonly adopted methods for obfuscation are:

Packing: This involves compressing the executable file. On compression, the hash of the file changes compared to the original one and many strings become incomprehensible. So, for a person relying on these two factors for static analysis, the outcome may not be correct.

Encryption: The code is encrypted to make it's analysis further, difficult.

Encoding: It is quite similar to encryption, but it does not use keys. An example is Base64 encoding.

Dead Code Insertion: This makes the code difficult to analyze but does not affect the working of the file.

•