Malware Evasion Techniques

In order to understand how these specific APIs work, we must also understand the fundamentals of virtual memory and how it works inside the core of the machine we are analyzing malware on.

Before virtual memory was developed, physical memory address space (RAM) was slow and inflexible. Because computers back then had limited resources, it caused several issues:

• Multiple programs running simultaneously and pointing to the same physical address
• Causes memory fragmentation which results in having bits and pieces of unused memory space

With the implementation of virtual memory, computers use a technique called paging that checks RAM to see if there is enough space in the physical memory. If there isn’t, it will pull out the oldest piece of code and give it a virtual address which serves as a reference point for a program to retrieve later. Once the code is pulled out of the physical memory with the virtual memory address, it gets allocated as a page file on the hard disk, freeing up the space in RAM for new processes

Now that we grasped a general knowledge on how virtual memory address works, we will dive deeper into some of the techniques used by malware.

Unpacking, which is also known as executable compression, is a technique to hide malware itself. This technique can be carried out by calling a Windows API named VirtualAlloc. The purpose of VirtualAlloc is that it reserves or commits a region of pages in the virtual address space in a process. Using this API, malware often stores its malicious packed code in virtual memory address with a flag set to private. Setting the flag to private ensures that no other processes can access the malicious code. Once the code is allocated to virtual memory address, it will wait until the malicious file gets executed by a user and will get unpacked in memory to carry out malicious commands.

In addition, malware authors typically implement VirtualAlloc in different parts of the code, making it more difficult for analysts to determine the exact address of the malicious code. A typical pattern observed with several VirtualAlloc calls is that many of these calls will point to what’s known as junk code, or code that doesn’t do anything, which is another technique use by malware to make malware analysis more time-consuming.

Another evasive technique used by malware is process injection. This technique works by injecting malicious code into a separate live process that masquerades as a legitimate process. In order to perform process injection, malware often relies on the API called VirtualAllocEx.

VirtualAllocEx works like VirtuaAlloc except it comes with additional features; It can allocate virtual memory address space inside a specified process. The typical steps that malware follows for this technique are:

• Malware loops through a list of running processes using Windows APIs called Process32First and Process32Next and checks the name of each process.
• Once the target is found, malware calls VirtualAllocEx to allocate virtual memory address located inside the targeted process for code injection.
• Malware copies the code into the process using WriteProcessMemory API.