Tools that hide malicious code - A systematic review

Authors:

  • Hannes Holm
  • Erik Hyllienmark
  • Mats Persson

Publish date: 2022-12-16

Report number: FOI-R--5366--SE

Pages: 36

Written in: Swedish

Keywords:

  • Systematic review
  • malware
  • obfuscation

Abstract

This report describes a systematic review of tools available on Github that can prevent the discovery of malicious code. A total of 174 tools were categorized according to four overall categories: project metadata, supported architectures and file formats, defence against static analysis, and defence against dynamic analysis. The results showed that most of the tools employed one application to encrypt the malicious code, and a loader application to decrypt and execute the obfuscated code on a target machine. They also showed that most tools were created for educational purposes rather than to be effective.