Multi-path exploration guided by taint and probability against evasive malware

Open Access

Table 1.

Evasive techniques and the low-level implementation

Category		Instruction	System call	API
Hardware	CPU	cpuid		GetSystemInfo
		read memory		WMI¹

	Device		registry²	GlobalMemoryStatusEx
			NtUserCallTwoParam	GetDiskFreeSpace
			NtUserEnumDisplayDevices	GetPwrCapabilities
				GlobalMemoryStatusEx
				SetupDiGetDeviceRegistryProperty
				WMI
				WNetGetProviderName

	Driver			GetDeviceDriverBaseName

	Firmware		NtQuerySystemInformation	GetSystemFirmwaretable

Network adapter			GetAdaptersInfo
			WMI

Software	File		NtCreateFile	FindFirstFile
				NtQueryAttributesFile
				NtQueryDirectoryObject

	Module		NtQuerySystemInformation	GetModuleFileName
				GetModuleHandle

	Process		NtQuerySystemInformation	Process32Next
				NtQueryInformationProcess

	Service			EnumServicesStatusExW
				QueryServiceConfig

	System		registry	GetEnv

	Window text		NtUserFindWindowEx

Timing		rdtsc	NtQueryPerformanceCounter	GetTickCount

Running status	Instruction address	in
		int 2e

	Debugging	read memory³	NtQueryObject	CheckRemoteDebuggerPresent
			NtQuerySystemInformation	GetThreadContext
			NtQueryInformationProcess	IsDebuggerPresent

Note: ⁽¹⁾WMI represents WMI queries through WMI_Get(“SELECT ...”).

⁽²⁾Registry represents registry operations, including NtEnumerateKey, NtOpenKey, and NtQueryValueKey.

⁽³⁾Read memory represents accessing specific memory addresses, like PEB.

Current usage metrics show cumulative count of Article Views (full-text article views including HTML views, PDF and ePub downloads, according to the available data) and Abstracts Views on Vision4Press platform.

Data correspond to usage on the plateform after 2015. The current usage metrics is available 48-96 hours after online publication and is updated daily on week days.

Initial download of the metrics may take a while.