value:  Gamaredon Group has obfuscated .NET executables by inserting junk code. ;; Goopy has had null characters padded in its malicious DLL payload. ;; Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size. ;; Higaisa performed padding with null bytes before calculating its hash. ;; Javali can use large obfuscated libraries to hinder detection and analysis. ;; Before writing to disk Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections. ;; Leviathan has inserted garbage characters into code presumably to avoid anti-virus detection. ;; Maze has inserted large blocks of junk code including some components to decrypt strings and other important information for later in the encryption process. ;; Moafee has been known to employ binary padding. ;; Mustang Panda has used junk code within their DLL files to hinder analysis. ;; Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes. ;; POWERSTATS has used useless code blocks to counter analysis. ;; Rifdoor has added four additional bytes of data upon launching then saved the changed version as C:\ProgramData\Initech\Initech.exe. ;; SamSam has used garbage code to pad some of its malware components. ;; TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2. ;; A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products. ;; yty contains junk code in its binary likely to confuse malware analysts. ;; ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions."
name: Obfuscated Files or Information: Binary Padding