Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.^[1] The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.^[2] Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.^[3]

ID: T1027.001

Sub-technique of: T1027

Tactic: Defense Evasion

Platforms: Linux, Windows, macOS

Data Sources: Binary file metadata, File monitoring, Malware reverse engineering, Process monitoring

Defense Bypassed: Anti-virus, Signature-based detection

CAPEC ID: CAPEC-572

Contributors: Martin Jirkal, ESET

Version: 1.0

Created: 05 February 2020

Last Modified: 20 June 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT32	APT32 includes garbage code to mislead anti-malware software and researchers.^[1]^[18]
BRONZE BUTLER	BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.^[22]^[23]
Comnie	Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.^[11]
CORESHELL	CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.^[10]
Emissary	A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.^[5]
FinFisher	FinFisher contains junk code in its functions in an effort to confuse disassembly programs.^[8]^[9]
Gamaredon Group	Gamaredon Group has obfuscated .NET executables by inserting junk code.^[24]
Goopy	Goopy has had null characters padded in its malicious DLL payload.^[17]
Kwampirs	Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.^[6]
Leviathan	Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.^[21]
MAZE	MAZE has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.^[15]
Moafee	Moafee has been known to employ binary padding.^[20]
Patchwork	Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[19]
POWERSTATS	POWERSTATS has used useless code blocks to counter analysis.^[16]
Rifdoor	Rifdoor has added four additional bytes of data upon launching, then saved the changed version as `C:\ProgramData\Initech\Initech.exe`.^[14]
SamSam	SamSam has used garbage code to pad some of its malware components.^[13]
XTunnel	A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.^[7]
yty	yty contains junk code in its binary, likely to confuse malware analysts.^[4]
ZeroT	ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.^[12]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool. When executed, the resulting process from padded files may also exhibit other behavior characteristics of being used to conduct an intrusion such as system and network information Discovery or Lateral Movement, which could be used as event indicators that point to the source file.

Obfuscated Files or Information: Binary Padding

Other sub-techniques of Obfuscated Files or Information (5)

Procedure Examples

Mitigations

Detection

References