Skip to content

Latest commit

 

History

History
46 lines (39 loc) · 1.53 KB

executable-code-optimization.md

File metadata and controls

46 lines (39 loc) · 1.53 KB
ID B0034
Objective(s) Anti-Static Analysis
Related ATT&CK Techniques None
Anti-Analysis Type Evasion
Version 2.0
Created 1 August 2019
Last Modified 10 November 2022

Executable Code Optimization

Code is optimized, making it harder to statically analyze.

Methods

Name ID Description
Jump/Call Absolute Address B0034.001 Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.
Minification B0034.002 Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [1] A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.

References

[1] https://en.wikipedia.org/wiki/Minification_(programming)