Anti-Anti-Debugging Study to Understand and Disable Anti-Debugging for Malware Analysis

초록

Recently, e-mail attacks and spear phishing attacks, which purported to be corporations and civil servants, are taking root. Among the attack techniques, a phishing technique for redirecting a user to a spoofed Web site hosted with malicious code to induce input of personal and financial information of the user, and to exploit a crime has been used. Although the development of vaccine programs has been constantly updated to prevent such threats, attackers who make malicious code can use various technologies to interfere with and delay analysis of analysts and apply various techniques to increase the life span of malicious code and combines it with social engineering techniques to enhance malicious code. Anti-debugging is a typical technique used for malicious code concealment. Anti-debugging is used to protect malware it-self. In this paper, we describe the packing method for concealing malicious code and the anti-debugging technique for protecting malicious code as described above. In addition, we proposed anti-anti-debugging schemes to disable anti-debugging techniques and applied and analyzed example programs to verify the anti-debugging behavior and the anti-anti-debugging scheme proposed in this study. © 2020, Korean Institute of Communications and Information Sciences. All rights reserved.

키워드