Analysts read code to understand it. Junk code gives them a lot of the wrong thing to read.
MITRE tracks this as Junk Code Insertion, technique T1027.016, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Junk or dead code either never runs or runs without changing what the program does. It makes analysis slower, because the analyst steps through instructions that do nothing. It can also get past detections that depend on static code analysis, since it adds benign functionality, especially combined with compression or software packing.
MITRE's example is the No-Operation (NOP) instruction in x86 assembly, usually the 0x90 opcode. When NOPs are added to malware, a disassembler shows them and the analyst has to step through each one.
MITRE draws a line between this and Binary Padding. Padding exists to change a file's signature. Junk code exists to hide what the code does.
How to detect it
MITRE's strategy (DET0322) looks at the file and what happens next:
- Windows. Executables with a lot of NOP padding or an unusually large size for their function, then execution or memory injection, especially from temp or user paths.
- Linux. ELF binaries written to disk with strange size or entropy, quickly followed by execution or writes into remote process memory, for example through ptrace.
- macOS. Mach-O binaries dropped in temp directories with high size or padding patterns, followed by privilege escalation, exec or memory mapping of other processes.
How to reduce the risk
MITRE lists one mitigation: antivirus and antimalware. It adds that behavior based detection, rather than reliance on static code analysis, may identify files that depend heavily on junk code.
Quick check
How does junk code insertion differ from binary padding?
Padding is meant to change the file's signature. Junk code is meant to obscure the functionality of the code and slow analysis.
Sources
- MITRE ATT&CK, Junk Code Insertion (T1027.016)
