Obfuscated Files or Information: Binary Padding

APT29 has used large file sizes to avoid detection.^[4]

APT32 includes garbage code to mislead anti-malware software and researchers.^[1][5]

Bisonal has appended random binary data to the end of itself to generate a large binary.^[6]

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.^[7][8]

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.^[9]

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.^[10]

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.^[11]

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.^[12]

FatDuke has been packed with junk code and strings.^[13]

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.^[14][15]

Gamaredon Group has obfuscated .NET executables by inserting junk code.^[16]

Gelsemium can use junk code to hide functions and evade detection.^[17]

Goopy has had null characters padded in its malicious DLL payload.^[18]

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.^[19]

GrimAgent has the ability to add bytes to change the file hash.^[20]

Higaisa performed padding with null bytes before calculating its hash.^[21]

Javali can use large obfuscated libraries to hinder detection and analysis.^[22]

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.^[23]

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.^[24]

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.^[25]

Moafee has been known to employ binary padding.^[26]

Mustang Panda has used junk code within their DLL files to hinder analysis.^[27]

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.^[28]

POWERSTATS has used useless code blocks to counter analysis.^[29]

QakBot can use large file sizes to evade detection.^[30][31]

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.^[32]

SamSam has used garbage code to pad some of its malware components.^[33]

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.^[34]

WastedLocker contains junk code to increase its entropy and hide the actual code.^[35]

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.^[36]

yty contains junk code in its binary, likely to confuse malware analysts.^[37]

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.^[38]