Polymorphic vs Metamorphic (detection perspective)
Polymorphic: same payload encrypted each instance with different keys/packer; decryptor stub changes but core malicious logic is identical. Detection can target decryptor patterns or post-decryption payload. Metamorphic: reorders, rewrites or recompiles code so the payload itself changes structurally — much harder to find invariant bytes.
Limitations of static signatures
- Rely on byte/sequence invariants; polymorphism breaks signatures targeting encrypted body and metamorphism removes structural invariants.
- High false negatives for evolved samples; brittle to obfuscation and custom packers common in pen tests.
Emulation / Sandboxing: role and cost
- Emulation executes code to reveal decrypted or deobfuscated behavior (recover payload) — effective against polymorphic stubs. Sandboxing adds API/OS interaction tracing to see behavior.
- Costs: CPU/time intensive, evasive malware detects sandbox (timers, environment checks), scalability limits for large sample sets and live assessments.
Behavioral heuristics + Generic unpacking (complementary approach)
- Behavioral heuristics: monitor API calls, network patterns, persistence actions, and anomalies (process injection, memory writes, reflective loading). Good for catching metamorphic variants because they converge on harmful actions.
- Generic unpackers: instrument runtime to capture memory dumps after unpacking/decryption; combine with emulation to extract payload for further analysis.
- Combined strategy: use lightweight heuristics to triage suspicious samples, then apply emulation/generic unpacking for deeper analysis — balances coverage, speed, and resource cost.
In pen-testing, I prioritize heuristic triage to reduce sandbox load, and develop custom generic-unpacking scripts for repeatable families encountered during engagements.
