• 6ddv8 Delimiter Hex-Split Obfuscation An AutoIt obfuscation variant where hex-encoded payloads are split across hundreds of string-concatenation lines (`$VAR &= "..."`), each fragment polluted with the fixed five-character delimiter `"6dd
• NtQuerySystemInformation Module Enumeration Using `NtQuerySystemInformation` with `SystemModuleInformation` (class 5) returns the list of loaded kernel modules and their base addresses. Malware uses this to detect specific drivers (VM tools, ED
• SeDebugPrivilege Escalation Enabling `SeDebugPrivilege` on the current process token grants access to any process on the system, bypassing standard DACL checks. Malware enables this privilege before injecting into or reading mem
• AMSI Bypass via Byte-Signature Patching A .NET defense-evasion technique in which the malware dynamically resolves `amsi.dll` exports (`AmsiInitialize`, `AmsiOpenSession`, `AmsiScanBuffer`), then scans the function prologues for known byte
• AMSI Bypass Patch Byte See [[amsi-bypass-byte-patch]] for the full technique description.
• aspnet_compiler process-name sandbox evasion A behavioral sandbox-evasion technique in which malware checks the process list for the presence of `aspnet_compiler.exe` before executing its payload. The absence of this process indicates a non-deve
• AutoIt Delimiter + Reverse String Obfuscation A simple but effective string-obfuscation pattern observed in AutoIt-compiled malware. The script encodes sensitive strings (API names, DLL names, payload data) by inserting a fixed delimiter between
• AutoIt Hex-Split String Obfuscation An AutoIt obfuscation pattern where hex-encoded payloads are broken into tiny fragments and distributed across hundreds of string concatenation lines (`&=`), each fragment polluted with a fixed delimi
• autoit-overlay-script-placement Placement of a compiled AutoIt v3 script in the file overlay (after the last PE section) rather than inside a `.rsrc` RT_RCDATA resource. This evades automated extraction tools such as `autoit-ripper`
• AutoIt Shellcode XOR Decryptor A shellcode pattern observed across the [[unclassified-autoit-compiled]] cluster where an x86 shellcode stub, executed via `VirtualAlloc` + `DllCallAddress`, builds a variable-length XOR key on the st
• AutoIt Stride-3 Hex String Decoder (L300YQJRH) A custom string-obfuscation function observed in compiled AutoIt3 single-file PE droppers. Decoded strings include API names (`kernel32.dll`, `GetTickCount`), type names (`dword`, `long`, `ptr`, `str`
• AutoIt timing-gate sandbox evasion An anti-debug / anti-sandbox gate implemented in AutoIt malware. The script records the value of `GetTickCount` before a `Sleep` call, sleeps for a known duration (commonly 500 ms), then records `GetT
• Batch File Concatenation Obfuscation A DOS batch-script anti-static technique in which a binary payload is split into multiple fragments, each stored as a separate file with a meaningless name. A batch script uses hundreds of `SET` varia
• Batch PowerShell Variable Expansion Obfuscation A DOS batch-script anti-static technique in which a PowerShell payload is fragmented across tens of `SET` variable assignments, then reassembled in a single line via `%VARNAME%` expansion and passed a
• Caesar-3 Hex Shellcode Staging AutoIt malware pattern: shellcode bytes are encoded as a hex string (e.g., `0x558bec...`), then each character of the hex string is Caesar-shifted by +3, and the result is stored as a large string var
• CallWindowProc Shellcode Injection A process-injection technique that abuses the `CallWindowProcW` API from `user32.dll`. Because `CallWindowProc` accepts a callback address (`lpPrevWndFunc`) and up to four arguments, it can be repurpo
• Character-Skip Cipher PowerShell Obfuscation A simple but effective static-avoidance technique used in PowerShell malware: sensitive strings (URLs, API calls, paths, headers) are hidden inside noise-padded literals. The decoder extracts every Nt
• ClickOnce Certificate Trust Bootstrap A signed PE installs its own Authenticode publisher certificate into the Windows `TrustedPublisher` store, then uses the `SPC_SP_OPUS_INFO_OBJID` (1.3.6.1.4.1.311.4.1.1) attribute inside that signatur
• ConfuserEx Obfuscation ConfuserEx is an open-source .NET obfuscator that rewrites managed assemblies to impede reverse engineering. It operates at the IL level, applying heavy name mangling, constant encryption, control-flo
• CPlApplet PNG Payload Dropper A two-stage dropper pattern where a `CPlApplet` DLL (often with a `.scr` extension) masquerades as a Windows screensaver. Instead of containing the malicious payload inline, it expects a companion fil
• Debug-Build CAPA False Positives When capa analyzes .NET assemblies compiled in Debug configuration, several compiler-generated attributes trigger ATT&CK technique matches that are semantically incorrect. The most common false-positi
• Delphi VCL Certificate Harvesting A build/RE pattern where Delphi VCL RTL bloat inflates a small certificate-stealing payload into a 1.5–5 MB PE, making static triage noisy and behavioural analysis harder because the import table is d
• Delphi VCL Native Stub → .NET Metadata Loader A delivery chain in which a Borland Delphi VCL native PE32 executable acts as a dropper/loader for an inner .NET Framework payload. The .NET assembly is stored without a standard MZ+PE header — only r
• DllCallAddress Shellcode Execution An AutoIt-specific technique for executing shellcode reflectively. The AutoIt script decodes a payload (typically hex-encoded or XOR-encrypted shellcode), allocates executable memory via `VirtualAlloc
• .NET AssemblyResolve Reflective Plugin Loader **What it does**
• dotnet-clipboard-ole-hijack — OLE IDataObject COM interop for clipboard manipulation in .NET A .NET-specific collection technique in which malware uses the Windows OLE `IDataObject` COM interface (via `System.Runtime.InteropServices.ComTypes.IDataObject`) to read, write, and enumerate clipboa
• .NET Native AOT Compilation for Malware .NET Native AOT (ahead-of-time compilation via `PublishAot`) compiles managed IL into native machine code, producing a self-contained PE with **no CLR header, no IL metadata, and no COM_DESCRIPTOR dir
• double-extension-masquerade Abuse of Windows Explorer's "Hide extensions for known file types" default to present a malicious PE as a benign file type. The attacker appends a fake extension before the real one — e.g., `Payment_P
• UAC Bypass via Event Viewer (eventvwr.exe) Auto-elevate bypass abusing the .msc file handler registration. Event Viewer (`eventvwr.exe`) is a signed Microsoft binary that auto-elevates; it shells out to `mmc.exe` using the `Shell\Open\Command`
• Function Return-This Global Construction A JavaScript obfuscation technique used in Windows Script Host (WSH) environments to access the global `WScript` object without hardcoding its name. The idiom `Function('return this')()` constructs an
• Fused String API Decoding A Go anti-analysis technique where Windows DLL names and their exported API names are concatenated into single large strings in `.rdata`, then sliced at runtime into individual `syscall.LoadLibrary` /
• German LCID Sandbox Gate A sandbox-evasion technique used by JScript droppers to restrict execution to German-speaking Windows systems. The script reads `HKCU\Control Panel\International\Locale` via `WScript.Shell.RegRead`, p
• GetTickCount Anti-Emulation Loop An anti-emulation technique that repeatedly calls `GetTickCount` (or `QueryPerformanceCounter`) and measures elapsed time between operations. Emulators and sandbox hooks often artificially speed up or
• go-fake-sourcepath-masquerade — Go pclntab source-path injection for vendor masquerade Go binaries compiled with the standard toolchain embed a program-counter-to-line-number table (`pclntab`) used for stack traces and panics. This table retains the original source-file paths, including
• Go Function Name Randomization Anti-static technique observed in Go-compiled malware where the `main` package functions are given random alphanumeric names at build time. The Go compiler preserves these names in the `.gopclntab`/`.
• IFEO Offline Hive Paralyze A technique to disable security tools by modifying the Image File Execution Options (IFEO) registry hive offline — bypassing real-time AV hooks that monitor live registry writes.
• JS Control-Flow Flattening + String-Array Obfuscation A JavaScript obfuscation pattern produced by the `javascript-obfuscator` npm package (or compatible tooling), observed in JScript/WScript droppers targeting Windows. Combines three anti-static techniq
• js-custom-noise-obfuscation Custom JavaScript obfuscation technique characterised by embedding the real payload at the end of a massive noise block, then wrapping meaningful strings in a split-string array with comma-separated c
• JS Dictionary Character Lookup Obfuscation A JavaScript obfuscation technique that maps a large set of natural-language keys (typically English words or phrases) to single ASCII characters, then assembles the real payload at runtime by concate
• js-fixed-delimiter-concat-obfuscation JScript anti-static technique: split payload across hundreds of `+=` string-concatenation lines, interleaving a fixed noise token between every payload character. The noise token is stripped at runtim
• JS Noise-Payload Reassignment Eval A hand-rolled JavaScript/JScript obfuscation technique that hides a real payload inside a massive repetitive noise string, then extracts it via sequential variable-reassignment statements and executes
• JS Noise-Variable Concatenation Obfuscation JScript obfuscation technique where random-length noise variable names (15–20 lowercase characters, no semantic content) are assigned single-character string values, then concatenated via `+` operator
• JScript Hex+ROT WMI Reflective Dropper A three-stage JScript obfuscation pipeline followed by WMI hidden-process creation and a PowerShell reflective .NET assembly loader. Observed in Polish-language purchase-order spam lures.
• JScript Sequential Variable Reassignment Eval Obfuscation A hand-rolled JavaScript/JScript obfuscation technique that hides a real payload by splitting every character into a separate variable assignment statement. Each unique variable name is assigned a cha
• K30ZWMBJJ String Obfuscation A custom string-obfuscation function found in the decompiled AutoIt script of the `b017d189` sample. It protects shellcode-staging API names and file paths from static string extraction. The technique
• Kill-Switch Domain Check A malware sample contains a hardcoded domain or URL that it queries at startup (typically via HTTP GET). If the query succeeds — meaning the domain is registered, resolves, and returns any HTTP respon
• LZSS Payload Decompression LZSS (Lempel-Ziv-Storer-Szymanski) is a sliding-window dictionary compressor used by the SilverFox/ValleyRAT cluster to hide its second-stage payload inside the PE. At runtime, a small decompressor st
• LZSS/XZ Embedded Decompressor Custom in-memory LZSS-style decompressor observed in the [[esmk-crypter-loader]] family. The engine uses a sliding-window hash table for match lookup and emits back-reference / length pairs. The magic
• Marker File Mutex Gating A lightweight runtime gating mechanism: the dropper checks for the existence of a specific file (typically under `%appdata%` or `%TEMP%`). If present, the gated payload branch is skipped. If absent, t
• MessagePack Asynchronous RAT Protocol A .NET C2 wire-format protocol used by [[asyncrat]] and conceptually related to the [[protobuf-net-asymmetric-client-rat-protocol]] seen in [[quasar]]. MessagePack-serialized objects are transmitted i
• MSVC Stub Data-Section Payload Loader Malware build pattern: a small MSVC C++ outer PE carries an encrypted threat payload inside its `.data` section. At runtime the stub hides the console, delays execution via a PRNG-derived `Sleep`, all
• Nibble-Encoded Resource Payload A lightweight pre-decryption obfuscation layer observed in the [[esmk-crypter-loader]] family. Before the main decryption routine runs, the payload bytes extracted from the PE resource section are nib
• NSIS LZMA Embedded Payload Hiding Malware authors compile a Nullsoft Scriptable Install System (NSIS) self-extracting installer and embed the malicious payload as one or more files inside the LZMA-compressed archive appended after the
• P3059Y1DO Stride-3 Decimal String Obfuscation A custom string-obfuscation function used by the `unclassified-autoit-compiled` cluster of AutoItSC droppers. The function iterates over an input string in steps of 3, takes the first two characters o
• PEB-Walking API Resolution Position-independent code resolves Win32 API addresses at runtime by walking the Process Environment Block (PEB) linked list of loaded modules, then traversing the export table of `ntdll.dll` or `kern
• Phorpiex loader initterm payload staging Phorpiex droppers (observed in the `dropped-by-phorpiex` corpus) use the MSVCR90 C runtime `initterm` / `initterm_e` callback arrays to execute a non-trivial payload *before* `main()` is reached. The
• poem-word-list-steganography A custom steganography technique where a malware author composes a fixed-length word list (typically 256 words to map directly to byte values 0x00-0xFF) written as natural-language prose — often a poe
• powershell-cradle-downloader A malware delivery pattern where a compiled binary (PE, .NET, or script) calls `powershell.exe -Command` (or `-EncodedCommand`) to execute a one-line or multi-statement payload string inline. The Powe
• Process Hollowing Targeting svchost.exe / RegSvcs.exe A manual PE loader / process hollowing technique embedded in x86 shellcode dropped by the `unclassified-autoit-compiled` AutoItSC cluster. The shellcode decrypts an inner payload (typically a .NET ass
• Process Hollowing A defense-evasion technique where a benign process is created in a suspended state, its memory is unmapped or overwritten, and malicious code is written into the hollowed space before the thread is re
• protector-lab-overlay Protector Lab (`plab`) is a commercial Windows PE packer / protector that encrypts the real payload into a large AES-256-GCM overlay appended to the end of the PE file. The outer stub is a MinGW-w64 o
• Protobuf-net Asymmetric Client–RAT Protocol A .NET remote-access trojan (RAT) communication pattern using protobuf-net as the serialization layer over an asynchronous TCP socket. The server acts as a listener; the client initiates an encrypted
• Python Embeddable Runtime with EnumDesktopWindows Callback Injection A multi-stage dropper that bundles a full Python embeddable Windows runtime inside a ZIP archive. The entry script is heavily obfuscated, decodes to a `ctypes` loader, allocates RWX memory, copies an
• Python-Packed Payload Malware logic authored in Python, compiled to `.pyc`/`.pyo`, and bundled inside a Windows PE via PyInstaller, py2exe, or cx_Freeze. The outer PE is a stock bootloader; the actual IOCs, C2 logic, and e
• raw-socket-ddos-flooder Technique where malware opens `SOCK_RAW` (or `SOCK_PACKET`) sockets with `IP_HDRINCL` to craft Layer-3/Layer-2 packets directly. Used to generate high-volume DoS traffic with spoofed or randomised sou
• raw-tcp-c2-socket — Raw TCP socket C2 without application-layer framing Malware that communicates with its operator over raw TCP sockets without wrapping the payload in HTTP, HTTPS, DNS, or another application-layer protocol. The C2 traffic is typically a custom byte stre
• RC4-encrypted PowerShell payload staging A malware staging technique in which a PowerShell payload is encrypted with RC4 and delivered inside another script (e.g. JavaScript or batch). At runtime, the outer script decrypts the RC4 ciphertext
• RC4 In-Place Section Decryption The PE's `.text`, `.data`, and import sections are encrypted with RC4 at build time. A small bootstrap stub embedded at entry point performs in-place RC4 decryption using a key derived from XOR-obfusc
• RC4 + XOR Double-Stage Driver Decryption A two-stage decryption routine where an embedded driver image is first decrypted with a hardcoded RC4 key, then passed through an additional XOR pass before being written to disk and loaded into the k
• rdata-encrypted-payload-loader Malware build pattern: the threat payload is encrypted and stored inside the `.rdata` section of a PE loader stub. At runtime the stub copies the ciphertext into a freshly allocated heap, decrypts it
• Reflective Assembly Delegate Execution A .NET execution technique in which a byte array (decrypted from a resource, overlay, or network stream) is loaded into memory via `Assembly.Load(byte[])` and then invoked through `MethodBase.Invoke`,
• Registry-Segmented Payload Staging A payload staging technique where a dropper splits a large string (Base64, hex, or raw) into fixed-size segments (typically 10 000–20 000 characters) and stores each segment as a separate `REG_SZ` val
• RtlGetVersion OS Build Gating An anti-sandbox / anti-emulation gate that resolves `RtlGetVersion` from `ntdll.dll` at runtime, fills an `OSVERSIONINFOEXW` struct, and validates `dwBuildNumber` against a hardcoded minimum (e.g. `0x
• Rust Async RAT Framework A recurring build pattern observed in modern Windows RAT/stealer families: native Rust compiled with the MSVC toolchain, using `tokio` for async I/O, `tokio-tungstenite` for WebSocket C2, `serde_json`
• S30K9CPG Caesar-5 XOR String Obfuscation A string-obfuscation function used in AutoIt-compiled droppers within the [[unclassified-autoit-compiled]] cluster. Decodes API names and DLL paths by subtracting 5 from each ASCII value, then XORing
• Semantic Jargon Export Obfuscation A PE export table is populated with hundreds of plausible-sounding function names drawn from unrelated technical domains (machine learning, networking, game engines, DevOps). The names are syntactical
• SendKeys PowerShell Injection A defense-evasion technique where a Visual Basic or JScript dropper launches `powershell.exe` in a visible window, then uses `WshShell.SendKeys` to inject keystrokes into the PowerShell console as if
• SmartAssembly Obfuscation SmartAssembly is a commercial .NET obfuscator/packer by Redgate. Malware authors abuse its string encryption, control-flow obfuscation, and anti-tamper features.
• Social-Engineering Filename Lure Malware distributors repackage benign or malicious executables with filenames that mimic legitimate business documents — purchase orders, invoices, shipping bills, payment advices, salary slips, RFQs
• stolen-authenticode-certificate-signing **Technique:** Signing a benign or malicious binary with a stolen, expired, or revoked code-signing certificate to bypass Windows SmartScreen, application whitelisting, and user suspicion.
• TLS Callback Anti-Analysis — pre-execution code via Thread-Local Storage callbacks On Windows, PE files can declare a Thread-Local Storage (TLS) directory. The loader walks the `AddressOfCallBacks` array and invokes each function pointer **before** the executable's normal entry poin
• Trif32 Caesar-Shift-23 Decoder A trivial string-encoding utility class named `Trif32` that applies a Caesar cipher with a fixed shift of 23 positions (or equivalently, a left shift of 3). The string "Trif32" itself is likely a garb
• U30JZ3SO7 Permutation-XOR String Obfuscation A custom AutoIt string-obfuscation function that hides API names and string literals inside compiled AutoIt3 scripts. It combines a **key-scheduled permutation** ( Fisher-Yates-like shuffle driven by
• Unicode Control-Character Name Obfuscation .NET malware technique where all type names, method names, and sometimes field names are replaced with sequences of Unicode control characters (C0/C1 controls such as `U+0002`, `U+0003`, `U+0005`) and
• Userinit Registry Persistence Appending a payload path to the `Userinit` registry value under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`, causing the payload to execute every time a user logs on.
• version-info-masquerade Malware alters the `VS_VERSIONINFO` resource block to claim a legitimate company name, product name, and file description. Windows Explorer, task managers, and AV reputation engines display this metad
• WebDAV Regsvr32 DLL Sideloading A defense-evasion execution chain in which a script (JScript, batch, or VBScript) mounts an attacker-controlled WebDAV share via `net use \\host@port\DavWWWRoot\` and then calls `regsvr32 /s` to silen
• WinInet + URLMon Dual-Path HTTP Downloader A downloader that implements two independent HTTP fetch paths — a primary WinInet path (`InternetOpenW` → `InternetOpenUrlW` → `InternetReadFile` → `WriteFile`) and a fallback URLMon path (`URLDownloa
• WMI System Fingerprinting Windows Management Instrumentation (WMI) queries used by JScript/WScript droppers to harvest victim-system metadata before exfiltration. Typically queries `Win32_OperatingSystem` for caption, architec
• WScript LNK PowerShell Cradle A multi-stage execution chain observed in invoice-themed JavaScript droppers:
• x64 Architecture Check via Program Files (x86) An anti-sandbox / anti-emulation gate that checks for the presence of the `%SYSTEMDRIVE%\Program Files (x86)` directory via `PathFileExistsW`. This directory only exists on 64-bit Windows installation
• XMM Word-Wise Payload Decryption A payload-decryption technique that uses SSE2 XMM registers to operate on 128-bit blocks of encrypted data in-place. The typical sequence is:
• XOR-Encrypted PE Payload Staging A multi-stage payload delivery pattern where a secondary PE is written to disk encrypted with a repeating XOR key, then read back and decrypted in-memory by a shellcode loader before execution.
• XOR string decryption loop A static string obfuscation technique observed in Zig-compiled malware where encrypted blobs and their XOR keys are stored in `.rdata`, then decrypted at runtime into stack-allocated buffers before us
• XOR-decrypted .NET assembly reflective loading A defense-evasion technique in which a malware payload encrypts a .NET assembly with a simple XOR cipher, decrypts it at runtime in PowerShell, and loads it reflectively into the current process via `
• Z30PER Hex-Split String Obfuscation A string-obfuscation technique used in compiled AutoIt v3 scripts where plaintext strings are encoded as a sequence of 3-character groups. Each group consists of two hex digits representing one byte,
• Zig-compiled malware Malware compiled with the Zig programming language and its self-hosted compiler. Zig produces native PE/ELF/Mach-O binaries via LLVM/LLD with minimal runtime, making it an attractive target for author
• Zone.Identifier ADS Deletion A defense-evasion technique to remove the "Downloaded from Internet" mark from a freshly downloaded file. Windows appends an Alternate Data Stream (ADS) named `Zone.Identifier` to files fetched from t