Adding junk data to a program is one of the cheapest ways to make a known threat look new. The behavior stays the same. The file does not.
MITRE tracks it as Binary Padding, technique T1027.001, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Padding is junk data added to the on-disk form of malware, usually generated by a function and appended to the end or applied to sections of the file. It does not affect how the binary runs.
MITRE points to two effects. First, it changes the file's checksum, which defeats hash based blocklists and static antivirus signatures. Second, it can push the file beyond the size limits of some tools. Public scanning services, such as VirusTotal, cap the size of uploads, so a bloated file may not be scanned or collected for analysis.
How to detect it
MITRE's strategy (DET0553) has three analytics, one per platform family. In short, look for padded binaries that appear and then execute or are used to move to other hosts.
- Creation or execution of a file that is large but contains little real content, followed by process execution or lateral movement from that host.
- Unusually large binaries created and then run by non-standard users.
- Anomalous binaries written to disk and executed in a user or service context.
Hash reputation alone will not carry you here. Add file size against expected size for a given program, who wrote the file, and what it did when it ran.
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. The sensible defenses are the ones that do not rely on a hash:
- Behavior based detection that judges what a program does.
- Size limits in your scanning tools that you know about and have tuned, with alerts for files that exceed them.
- Application control, so that unknown executables do not run at all.
Quick check
What two things does binary padding defeat?
Hash based blocklists and static signatures, because the checksum changes, and tools with file size limits, because the file becomes too large to scan.
Sources
- MITRE ATT&CK, Binary Padding (T1027.001)
