App Review Packers, polymorphism and common misconceptions

[struppigel]

Content source

https://www.youtube.com/watch?v=ESLEf66EzDk

How do packers work? What is binary padding and why is not the same as polymorphism.
What is polymorphism in packers? Why is a scantime crypter not a packer? I answer all those questions in this video.

00:00 Intro
01:01 Why learn about packers?
01:36 Packer types
02:30 How packing works
03:50 Misconception: Packers inject stub into target
05:03 How packed files execute target file
06:11 Legit and malicious packers?
07:00 Misconception: Scantime crypter are packers
08:02 Target file placement in the stub
09:12 Binary Padding and why it is no polymorphism
10:03 Polymorphic packers
10:49 Oligomorphic packers
11:47 How polymorphism helps malware evade AVs
13:36 Metamorphism does not apply to packers

 

[cruelsister]

Thank you for an excellently clear (and produced) video. The point that you discussed at the end of the video regarding routine detection of packers by AV vendors is an important one for any that code malware. Sadly some AV vendors will by default flag a file malicious that would otherwise be considered legitimate simply because something like UPX was utilized. Microsoft is notorious for this with their "Trojan:Win32/Wacatac.B!ml" designation. This can, from time to time, be an inconvenience (not that I would know anything about it).