Obfuscated Files or Information: Binary Padding

APT29 has used large file sizes to avoid detection.^[4]

APT32 includes garbage code to mislead anti-malware software and researchers.^[1][5]

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.^[6][7]

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.^[8]

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.^[9]

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.^[10]

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.^[11]

FatDuke has been packed with junk code and strings.^[12]

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.^[13][14]

Gamaredon Group has obfuscated .NET executables by inserting junk code.^[15]

Goopy has had null characters padded in its malicious DLL payload.^[16]

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.^[17]

GrimAgent has the ability to add bytes to change the file hash.^[18]

Higaisa performed padding with null bytes before calculating its hash.^[19]

Javali can use large obfuscated libraries to hinder detection and analysis.^[20]

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.^[21]

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.^[22]

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.^[23]

Moafee has been known to employ binary padding.^[24]

Mustang Panda has used junk code within their DLL files to hinder analysis.^[25]

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[26]

POWERSTATS has used useless code blocks to counter analysis.^[27]

QakBot can use large file sizes to evade detection.^[28][29]

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.^[30]

SamSam has used garbage code to pad some of its malware components.^[31]

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.^[32]

WastedLocker contains junk code to increase its entropy and hide the actual code.^[33]

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.^[34]

yty contains junk code in its binary, likely to confuse malware analysts.^[35]

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.^[36]