Columbo: High perfomance unpacking Page 1 Columbo High Perfomance Unpacking Jason
Raber New Technologies, Malwarebytes Santa Carla, USA jraber@malwarebytes.com …

Traditional signature-based malware detection techniques rely on byte sequences, called
signatures, in executable for signature-matching. Modern malware authors can bypass …

Malwares attempt to evade AV scanners using various obfuscation techniques. Packing is a
popular obfuscation technique used by 80% of malwares. In this paper, we propose a …

Malware are packed to create new variants in order to evade signature-based detector or
reverse engineering (RE). According to the primary behaviors of packing, which are code …

Dumping is technically easier to achieve Static analysis often does not require a perfect
reconstruction of the original Unpacked samples are easier to utilize in dynamic analysis …

Malware analysts have to first extract hidden original code from a packed executable to
analyze malware because most recent malware is obfuscated by a packer in order to disrupt …

Malicious software (malware) attacks are an ever-increasing cyber-security problem. One
reason for this trend is the widespread adoption of packing technology as a way to mask the …

Run time packing is a common approach malware use to obfuscate their payloads, and
automatic unpacking is, therefore, highly relevant. The problem has received much attention …

When an analyst examines the binary of malware to obtain some useful information for
defense and mitigation, she is often required to extract its original binary first. Packing is the …

Reverse engineering packed binaries remain a tedious challenge as code packing is
continuously being used by malware to hinder detection and analysis. The problem of …