ID | B0034 |
Objective(s) | Anti-Static Analysis |
Related ATT&CK Techniques | None |
Anti-Analysis Type | Evasion |
Version | 2.0 |
Created | 1 August 2019 |
Last Modified | 10 November 2022 |
Code is optimized, making it harder to statically analyze.
Name | ID | Description |
---|---|---|
Jump/Call Absolute Address | B0034.001 | Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms. |
Minification | B0034.002 | Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [1] A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted. |
[1] https://en.wikipedia.org/wiki/Minification_(programming)