Payload encryption and obfuscation are commonly used to conceal the raw bytes of a payload inside an executable. Leaving a recognizable payload directly embedded in a file can expose byte patterns, strings, and other indicators that security solutions may identify during static analysis.
Although encryption and obfuscation both change how a payload is stored, they serve different purposes. Encryption transforms the payload using a cryptographic operation and requires a corresponding decryption routine to recover the original bytes. Obfuscation instead represents or rearranges the payload in a less obvious form without necessarily providing cryptographic protection.
Neither technique makes a payload undetectable. The original bytes must eventually be recovered before execution, allowing security solutions to inspect the program's behavior, memory, and runtime activity.
Payload encryption converts the original payload into encrypted data that does not directly contain its recognizable byte sequence. The program must decrypt the data at runtime before the payload can be used.
Encryption can reduce the effectiveness of static signatures that search for known payload patterns. However, the presence of encrypted data, a decryption routine, and suspicious runtime behavior may still contribute to detection.
The upcoming encryption modules will introduce the following algorithms:
Payload obfuscation changes the appearance or representation of the payload without necessarily encrypting it. For example, raw bytes can be converted into structured strings that resemble legitimate data formats. The program then converts those values back into their original binary form at runtime.
Obfuscation may conceal obvious byte arrays and make basic static inspection more difficult. However, the conversion routine and reconstructed payload can still be detected through static or runtime analysis.
The upcoming obfuscation modules will demonstrate payload representation using:
Although encryption and obfuscation can help prevent a payload from directly matching known static signatures. These techniques are less effective against behavioral analysis, memory scanning, emulation, and other runtime detection methods. Security solutions may also identify the routines used to decrypt or reconstruct the payload rather than detecting the stored payload itself.