Malware Function-based encryption technique

Recent malware often uses techniques to evade detection by cybersecurity products. One of the techniques is the encryption of executable code. Malware analysis techniques for decrypting executable code in memory have existed for some time. However, more recent malware has employed an advanced technique. This function-based encryption technique where the code is encrypted for each function and decrypted only when it is executed has substantially hampered these techniques. An effective way to analyze this technique was to trace the code. Possible methods of tracing are using debuggers and monitoring with tools. Debugger analysis can be successful in analyzing malware using this technique if analysts know a few key points. It is found that using a tracing tool was also effective. It is possible to manually analyze malware using this technique. However, it is also found it difficult to use the detection and analysis methods used so far. By understanding this technique and knowing effective analysis methods, it is necessary to evolve the detection and analysis methods.