Pith. sign in

REVIEW 4 major objections 6 minor 39 references

A characterisation of system-wide propagation in the malware landscape

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A 650-sample census finds 23.23% of malware propagates across multiple processes.

desk verdict Solid empirical map of malware propagation with a headline prevalence number that overreaches because of the family-balanced convenience sample. read the letter →

arxiv 1908.10167 v1 pith:KWCFZRA4 submitted 2019-08-27 cs.CR

David Korczynski This is my paper · ORCID
classification cs.CR
keywords malwarepropagationmulti-processexecutionwavesdynamicallygeneratedcodeinjectionsystem-widegraphdynamictaintanalysissandbox
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to give the first large-scale, systematic picture of system-wide malware propagation: how often malware spreads into multiple processes, how many different techniques it uses, where its sensitive behavior lands, and how that has changed over time. It analyses 650 samples from 65 families (10 per family) spanning 2012 to 2018 in a taint-tracking sandbox and condenses each execution into a system-wide propagation graph. The headline findings are that 23.23% of samples propagate across processes, 60% generate multiple execution waves of dynamically generated code, and the multi-process techniques reduce to 33 API-level signatures. These numbers give defenders and sandbox designers a grounded baseline for what normal malware propagation looks like, replacing anecdotal technique lists.

What carries the argument

The load-bearing object is the system-wide propagation graph (SPG), a directed weakly-connected graph whose nodes are execution waves and whose edges are control-flow transitions, with a designated entry node. An execution wave is each round of dynamically generated code identified by an information-flow model, regardless of which process or thread wrote it, which lets the study track unpacking and injected code without hooking common APIs such as CreateRemoteThread. The SPG organizes the raw taint trace into process-depth, wave-depth, and width, and it is the substrate for every statistic and signature in the paper.

What would settle it

Re-run a representative subset of these 650 samples on a 64-bit Windows 10 guest with an open browser, simulated user activity, and a longer recording window, then count multi-process samples; if the fraction moves well above 23.23%, or if samples known to inject into browsers still show no propagation, the single-environment numbers are not a stable estimate of in-the-wild behavior.

Watch

Extended reading notes

Core claim

The central claim is that system-wide propagation is prevalent, diverse, and behaviorally significant in the modern malware landscape. Using the Minerva sandbox's whole-system taint-based execution tracking, the author defines each malware execution as a system-wide propagation graph (SPG): nodes are execution waves, meaning rounds of dynamically generated code, and edges are control-flow transitions between them, with process information attached. Analysing 650 samples balanced across 65 families, the paper finds 151 samples (23.23%) with multi-process propagation, 40 families (62%) containing at least one such sample, 393 samples (60%) with multiple execution waves, and 33 distinct API-level propagation signatures, of which the classic OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread chain accounts for 174 of 417 injections (41.7%). Behaviorally, non-initial processes carry most Internet- and security-related API calls, while initial processes carry most of the code and most dynamically generated waves. The author concludes that propagation is a steady, diverse, long-standing feature rather than a growing one: no consistent upward trend appears from 2012 to 2018, and most novel signatures were invented before 2015.

Load-bearing premise

The central assumption is that one fixed execution environment, meaning 32-bit Windows 7 with no user interaction, a 25-second recording window, and no running browsers or office applications, shows enough of a sample's behavior to characterize how that malware propagates in the wild.

Editorial extensions

If this is right

  • Detection and analysis pipelines that watch only the first process will miss roughly a quarter of samples; multi-process tracing is needed to see their full behavior.
  • Because 60% of samples generate code dynamically, static unpacking alone is insufficient, and execution-wave tracking is a practical requirement for complete analysis.
  • The classic OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread chain remains the single highest-value detection target, but the 33 observed signatures show that detectors keyed to one API sequence will be evaded.
  • Malicious network and privilege operations concentrate in non-initial processes, so sandboxes that inspect only the initial process will under-report command-and-control and privilege-escalation behavior.
  • There is no monotonic increase in multi-process propagation or novel signatures over 2012 to 2018, so defenses should treat system-wide propagation as a steady baseline rather than a growing trend.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Pith inference: if the same 650 samples were re-run in a 64-bit environment or with an active browser and user interaction, the multi-process fraction would likely rise, because the paper itself notes that browser-injecting and 64-bit-only techniques are invisible in its setup.
  • Pith inference: the SPG depth and width metrics could serve as features for malware family classification, since the paper reports that 83% of samples in a family either share propagation signatures or do not propagate at all.
  • Pith inference: the paper's 'strict lower bound' framing suggests its percentages should be read as environmental baselines rather than true upper limits on in-the-wild behavior.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents a large-scale empirical study of host-based (system-wide) malware propagation. It introduces the system-wide propagation graph (SPG), a directed graph whose nodes are execution waves and whose edges are control-flow transitions, with process-depth, wave-depth, and SPG-width measures. Using the authors' Minerva taint-based whole-system emulation framework, the paper analyzes 650 Windows malware samples from 65 families (10 samples per family) spanning 2012-2018. It reports that 23.23% of samples (151/650) exhibit multi-process propagation, that 60% of samples exhibit multiple execution waves, that 33 distinct API-level propagation signatures were observed, and it analyzes target processes, code-injection versus dropper behavior, sensitive API usage in initial versus non-initial processes, temporal trends, and inter-family consistency. The paper includes detailed case studies of unusual injection techniques and an explicit discussion of limitations in Section 6.2.

Significance. If the quantitative claims hold, this is one of the first systematic, large-scale characterizations of system-wide propagation, and the SPG formalism plus the manually refined signature catalog (33 API-level signatures) could be valuable resources for the malware-analysis community. The authors deserve credit for manually verifying multi-process execution across the dataset, for presenting concrete case studies (e.g., the ZwCreateUserProcess hooking injection), and for explicitly stating in Section 6.2 that the single-environment, 25-second, no-interaction setup will miss behaviors. The main risk to significance is external validity: the headline prevalence figures are computed on a family-balanced convenience sample in one execution environment, so they are properties of that sample and environment rather than of the wider malware landscape. The paper's comparisons to prior work (Section 6.1) attribute differences to methodology without ruling out dataset-composition effects.

major comments (4)
  1. [4.1 Data collection; 6.1 Answers to research questions] The headline prevalence figures, including the 23.23% multi-process figure (151/650) and the 60% execution-wave figure, are unweighted statistics over a deliberately family-balanced sample: exactly 10 samples per family, with no sampling frame tied to real-world family prevalence. As Table 2 shows, propagation-heavy families (Madangel 10/10, Natas 9/10, Emotet 9/10, TinyBanker 9/10, Razy 9/10) are counterbalanced by 25 families with zero multi-process samples. Section 6.1 compares 23.23% with Palo Alto's 13.5% and Ugarte et al.'s 15.6% and attributes the difference to methodology, but family-balance is a competing explanation. Please either rephrase all prevalence claims as applying to the curated family-balanced sample, or provide evidence or weighting that the 65-family sample approximates wild prevalence.
  2. [4.3 Experimental set up; 4.5 False positive and false negative elimination; 6.2 Limitations] The study relies on a single 25-second run per sample, with no user interaction, a vanilla Windows 7 32-bit guest, and no benign applications beyond standard Windows processes. While Section 6.2 honestly acknowledges that this misses browser-injection behaviors and 64-bit-only techniques, the 'strict lower-bound' caveat in Section 4.5 addresses only under-detection within this environment, not the effect of the environment choice on the counts. The abstract's claim of a 'systematic study' of the 'malware landscape' and the RQ1 answer 'almost a quarter of malware samples rely on host-based propagation' should carry explicit qualifiers about the execution environment and the curated sample.
  3. [4.5 False positive and false negative elimination] The 99% API-call similarity threshold is a load-bearing component of the measurement pipeline: it determines which processes are declared over-tainted false positives and thus which samples count as multi-process. The paper describes the heuristic but provides no sensitivity analysis, no count of how many samples or processes were removed by it, and no independent ground-truth validation of the threshold. A different threshold could plausibly change the 151/650 count. Please report the number of processes evaluated and removed, and show how the prevalence results vary across a range of thresholds around 99%.
  4. [5.4.1 Propagation evolution; Figures 13-15] The RQ4 conclusion of 'no consistent change over the years' is based on yearly averages computed over the 10-per-family balanced sample, whose family composition differs by year (Figure 3). Because propagation behavior is highly family-dependent (e.g., Madangel 10/10 vs. many families with 0/10), the yearly fluctuation in average process count and in new-signature counts may reflect family-mix artifacts rather than temporal evolution. Please control for family composition (e.g., per-family-year analysis) or explicitly limit the temporal claim to the sample's family distribution.
minor comments (6)
  1. [Table 5] The SPG-width column header reads '1 2 4 4 5 6 7', which appears to be a typo; it should likely be '1 2 3 4 5 6 7' or the duplicate '4' should be corrected.
  2. [5.2.1 Target processes] The text says 'Table 6 shows the names of the most targeted processes', but the data appears in Figure 6; the cross-reference should be corrected.
  3. [Definition 4 (Section 3)] The definition of SPG-width as 'the maximum number of non-cyclic paths from the entry-point to all of the leaf nodes' is ambiguous: it could mean the total number of such paths, the maximum over leaves, or the number of leaves. Since this metric is reported in Table 5 and used in the RQ2 discussion, the definition should be clarified.
  4. [4.5 False positive and false negative elimination] The sentence 'All of the statistics we report in this paper are post false-positive elimination, including the input data set described in 4.1' is confusing, since the dataset was collected before analysis; rephrase to state that reported statistics exclude samples that failed to execute or were removed by the elimination step.
  5. [Table 8] The per-family signature notation in Table 8 (e.g., '(2, 2, 1) (17, 1, 1)') is compact but lacks an explicit legend in the caption; adding a one-line explanation of the triple (signature ID, injection count, sample count) would improve readability.
  6. [Abstract; Conclusion] The abstract and conclusion use phrases like 'systematic study on many real-world samples' and 'system-wide propagation in the malware landscape' without restating the limitations that Section 6.2 imposes; adding a sentence with the 'lower-bound, single-environment' qualifier would align the claims with the evidence.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper reports direct empirical measurements and a manually constructed taxonomy, with tool support from separate companion papers.

full rationale

This paper is an empirical measurement study, not a derivation, and I find no step in which a claimed result is equivalent to an input by construction. The headline numbers (151/650 multi-process samples, 393/650 with multiple execution waves, 33 distinct propagation signatures) are direct counts over execution traces produced by Minerva, whose taint-based design is described in Section 2 and whose precision is justified by a separate companion paper [24]; citing that prior tool paper is not circular because the tool's evaluation does not depend on the current sample statistics. The SPG formalisms (Definitions 1-4) are data-structure definitions, not derived predictions, and the reported depth/width statistics are computed from the defined graphs. The propagation signatures were manually built from the same samples ("We started our study with no signatures and then incrementally created signatures for each analysed sample," Section 4.4), but the paper presents them as an analyst-constructed taxonomy rather than as a fitted model predicting the data; the granularity dependence of the '33 signatures' count is acknowledged in Section 5.2.2. The false-positive elimination heuristic and the 'strict lower-bound' caveat in Section 4.5 are methodological safeguards, not by-construction reductions. The balanced-by-family sample design raises generalizability questions, but those are external-validity concerns under correctness risk, not circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 1 invented entities

The paper adds no fitted parameters or invented physical entities. The load-bearing assumptions are about the measurement instrument (Minerva taint tracing), the false-positive heuristic (99% API overlap), and data set representativeness. The only new conceptual entity is the SPG, which is a formalization rather than a speculation. The paper is honest about several limitations in Section 6.2, which supports the reading that most risk is in the single-environment, short-recording-time setup.

assumptions (3)
  • domain assumption Minerva's dynamic taint analysis accurately traces malware execution across processes and identifies all execution waves without requiring API hooks.
    The entire measurement apparatus depends on Minerva's correctness, which is described in the author's companion paper [24] and not independently verified in this paper. Over-tainting is handled heuristically (Section 4.5) but under-tainting (missing malicious execution) is not assessed.
  • ad hoc to paper The 99% API-call similarity threshold correctly separates over-tainted benign processes from true malicious propagation.
    Section 4.5 defines the threshold to allow for statically missed API calls, but gives no sensitivity analysis and reports zero false positives found, yet the total false-negative rate of the filter is unknown.
  • domain assumption The sample collection (650 samples, 10 per family, 65 families, detected by at least 13 AV vendors, at least 2 vendors agreeing on family) is representative of the Windows malware landscape.
    Section 4.1 explains the balancing choice and vendor thresholds, but the universe of malware families is not enumerated and the 13-vendor detection threshold biases toward well-known, widely detected malware, likely underrepresenting targeted or evasive samples.
invented entities (1)
  • System-wide propagation graph (SPG) independent evidence
    purpose: A formal data structure (V, E, v_alt) describing malware execution as a graph of execution waves and control-flow transitions, used to define process-depth, wave-depth, and SPG-width for quantitative analysis.
    The SPG is a measurement formalism, not a physical entity. It is validated indirectly: the Tinba example in Section 3.1 and the Natas example in Figure 4 demonstrate it on real samples, and the resulting statistics are the evidence. It provides a falsifiable handle in the sense that other analysts can compute the same SPG from the same traces, but no independent implementation or verification is shipped.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A characterisation of system-wide propagation in the malware landscape." pith.science (2026). https://pith.science/paper/KWCFZRA4

@misc{pith2026190810167,
  author       = {Pith},
  title        = {Pith review of: A characterisation of system-wide propagation in the malware landscape},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KWCFZRA4}},
  note         = {Machine review of arXiv:1908.10167}
}
read the original abstract

System-wide propagation is frequently observed in malware, and there are several resources, like blog posts and similar, that detail some of the techniques used. However, there is currently no thorough study on the subject at large, and the full extent of system-wide malware propagation remains unknown. In this paper, we perform a systematic study on many real-world samples to comprehensively characterise system-wide propagation within the malware landscape and the goal is to use detailed and precise analyses to derive high-level views. We achieve this by collecting a diverse set of malware samples, analyse them in our Minerva malware analysis framework and then extract vast amounts of statistics about the results. We use these results to provide an in-depth discussion centred on four main research questions.

Figures

Figures reproduced from arXiv: 1908.10167 by the authors.

Figure 1
Figure 1. ‡e system-wide propagation graph of Tinba malware sample. 4.1 Data collection Œe goal of our data collection is to establish a set of samples that broadly represents the Windows malware landscape over several years. To this end, we have collected samples from various kinds of malware, a diverse set of families and from an extended timeline. We identify the year a sample is from as the year the sample was €rst submiŠ… view at source ↗
Figure 2
Figure 2. Yearly-distribution of samples in our data set. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Yearly-distribution of families. processes are the targets of malware propagation, (2) which speci€c techniques are used for malware propagation and (3) the proportion of droppers versus code injections. (3) Are there clear relations between malicious behaviour and system-wide malware propagation? Œe goal of this research question is to identify how malware performs its malicious behaviours, e.g. achieves persistenc… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: ‡e system-wide propagation graph of Natas sample. Only processes are shown, and each process box contains the PID and the number of waves for the given process. 1 2 3 4 5 6 7 8 9 10 11 12 0 100 200 300 400 500 Number of processes Samples [PITH_FULL_IMAGE:figures/full_…
Figure 5
Figure 5. Figure 5: Number of processes involved in malware execu [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: ‡e processes that are the most popular targets for multi-process propagation. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Call graph of code injection that hooks ZwCreateUserProcess. API calls made by the malware are shown in bold. the export extractor in Minerva we know ZwCreateUserProcess is located at 0x77c46a98 and given the €rst instruction is turned into a trampoline to malware code…
Figure 8
Figure 8. Figure 8: ‡e malware execution trace of a code injection [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: ‡e number of execution waves in the initial pro [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: ‡e number of execution waves in non-initial pro [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 12
Figure 12. Figure 12: Sensitive API usage across initial and non-initial [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 15
Figure 15. Figure 15: ‡e years signatures were €rst used. 5.4.2 Inter-family propagation characteristics. Œroughout this paper, we have explored various family-related aspects of system￾wide malware execution, and we now continue in this domain by giving a more general assessment of inter-…
Figure 14
Figure 14. Figure 14: Number of di‚erent propagation signatures each [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 16
Figure 16. Figure 16: Average number and standard deviation of execution waves per family. ‡e plots are sorted by average starting [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 28 canonical work pages

  1. [1]

    Andrei Bacs, Remco Vermeulen, Asia Slowinska, and Herbert Bos. 2013. System- Level Support for Intrusion Recovery. In Detection of Intrusions and Malware, and Vulnerability Assessment, Ulrich Flegel, Evangelos Markatos, and William Robertson (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 144–163

    work page 2013

  2. [2]

    /T_homas Barabosch, Niklas Bergmann, Adrian Dombeck, and Elmar Padilla. 2017. /Q_uincy: Detecting Host-Based Code Injection A/t_tacks in Memory Dumps. In Detection of Intrusions and Malware, and Vulnerability Assessment - 14th Inter- national Conference, DIMV A 2017, Bonn, Germany, July 6-7, 2017, Proceedings . 209–229. h/t_tps://doi.org/10.1007/978-3-319...

    doi:10.1007/978-3-319-60876-1 2017

  3. [3]

    /T_homas Barabosch, Sebastian Eschweiler, and Elmar Gerhards-Padilla. 2014. Bee Master: Detecting Host-Based Code Injection A/t_tacks. InDetection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMV A 2014, Egham, UK, July 10-11, 2014. Proceedings . 235–254. h/t_tps://doi.org/10.1007/ 978-3-319-08509-8 13

    work page 2014

  4. [4]

    /T_homas Barabosch and Elmar Gerhards-Padilla. 2014. Host-based code injection a/t_tacks: A popular technique used by malware. In9th International Conference on Malicious and Unwanted So/f_tware: /T_he Americas MALW ARE 2014, Fajardo, PR, USA, October 28-30, 2014. 8–17. h/t_tps://doi.org/10.1109/MALWARE.2014.6999410

    arXiv 2014

  5. [5]

    Ulrich Bayer, Imam Habibi, Davide Balzaro/t_ti, and Engin Kirda. 2009. A View on Current Malware Behaviors. In 2nd USENIX Workshop on Large-Scale Exploits and Emergent /T_hreats, LEET ’09, Boston, MA, USA, April 21, 2009. h/t_tps://www. usenix.org/conference/leet-09/view-current-malware-behaviors

    work page 2009

  6. [6]

    Ulrich Bayer, Andreas Moser, Christopher Kruegel, and Engin Kirda. 2006. Dy- namic Analysis of Malicious Code. Journal in Computer Virology 2, 1 (01 Aug 2006), 67–77. h/t_tps://doi.org/10.1007/s11416-006-0012-2

    work page doi:10.1007/s11416-006-0012-2 2006

  7. [7]

    Magal Baz and Or Safran. 2017. Dridex’s Cold War: Enter AtomBombing

    work page 2017

  8. [8]

    Fabrice Bellard. 2005. QEMU, a Fast and Portable Dynamic Translator. In Pro- ceedings of the Annual Conference on USENIX Annual Technical Conference (ATEC ’05). USENIX Association, Berkeley, CA, USA, 41–41. h/t_tp://dl.acm.org/citation. cfm?id=1247360.1247401

    arXiv 2005

Show all 39 references
  1. [9]

    Guillaume Bonfante, Jose Fernandez, Jean-Yves Marion, Benjamin Rouxel, Fab- rice Sabatier, and Aur ´elien /T_hierry. 2015. CoDisasm: Medium Scale Con- catic Disassembly of Self-Modifying Binaries with Overlapping Instructions. In Proceedings of the 22Nd ACM SIGSAC Conference o...

    2015

  2. [10]

    Cozzi, M

    E. Cozzi, M. Graziano, Y. Fratantonio, and D. Balzaro/t_ti. [n.d.]. Understanding Linux Malware. In 2018 IEEE Symposium on Security and Privacy (SP) , Vol. 00. 870–884. h/t_tps://doi.org/10.1109/SP.2018.00054

    2018

  3. [11]

    Emanuele Cozzi, Mariano Graziano, Yanick Fratantonio, and Davide Balzaro/t_ti

  4. [12]

    Artem Dinaburg, Paul Royal, Monirul Sharif, and Wenke Lee. 2008. Ether: Malware Analysis via Hardware Virtualization Extensions. In Proceedings of the 15th ACM Conference on Computer and Communications Security (CCS ’08). ACM, New York, NY, USA, 51–62. h/t_tps://doi.org/10.114...

    2008

  5. [13]

    Brendan Dolan-Gavi/t_t, Josh Hodosh, Patrick Hulin, Tim Leek, and Ryan Whelan

  6. [14]

    Manuel Egele, /T_heodoor Scholte, Engin Kirda, and Christopher Kruegel. 2008. A Survey on Automated Dynamic Malware-analysis Techniques and Tools. ACM Comput. Surv. 44, 2, Article 6 (March 2008), 42 pages. h/t_tps://doi.org/10.1145/ 2089125.2089126

    2008

  7. [15]

    Adrienne Porter Felt, Ma/t_thew Fini/f_ter, Erika Chin, Steve Hanna, and David Wagner. 2011. A Survey of Mobile Malware in the Wild. In Proceedings of the 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM ’11). ACM, New York, NY, USA, 3–14. h/t_t...

    2011

  8. [16]

    HASHEREZADE. 2016. h/t_tps://github.com/hasherezade/demos

    2016

  9. [17]

    Andrew Henderson, Lok-Kwong Yan, Xunchao Hu, Aravind Prakash, Heng Yin, and Stephen McCamant. 2017. DECAF: A Platform-Neutral Whole-System Dynamic Binary Analysis Platform. IEEE Trans. So/f_tw. Eng.43, 2 (Feb. 2017), 164–184. h/t_tps://doi.org/10.1109/TSE.2016.2589242

    2017

  10. [18]

    Ashkan Hosseini. 2017. Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injec- tion Techniques. h/t_tps://www.endgame.com/blog/technical-blog/ ten-process-injection-techniques-technical-survey-common-and-trending-process

    2017

  11. [19]

    /T_homas Hungenberg and Ma/t_thias Eckert. 2018. h/t_tp://www.inetsim.org/

    2018

  12. [20]

    Ispoglou and Mathias Payer

    Kyriakos K. Ispoglou and Mathias Payer. 2016. malWASH: Washing Malware to Evade Dynamic Analysis. In 10th USENIX Workshop on Offensive Technolo- gies (WOOT 16) . USENIX Association, Austin, TX. h/t_tps://www.usenix.org/ conference/woot16/workshop-program/presentation/ispoglou

    2016

  13. [21]

    Min Gyung Kang, Pongsin Poosankam, and Heng Yin. 2007. Renovo: A Hidden Code Extractor for Packed Executables. In Proceedings of the 2007 ACM Workshop on Recurring Malcode (WORM ’07). ACM, New York, NY, USA, 46–53. h/t_tps: //doi.org/10.1145/1314389.1314399

    2007

  14. [22]

    Yuhei Kawakoya, Eitaro Shioji, Makoto Iwamura, and Jun Miyoshi. 2019. API Chaser: Taint-Assisted Sandbox for Evasive Malware Analysis. Journal of Infor- mation Processing 27 (2019), 297–314. h/t_tps://doi.org/10.2197/ipsjjip.27.297

    2019 doi

  15. [23]

    David Korczynski. 2016. RePEconstruct: reconstructing binaries with self- modifying code and import address table destruction. In IEEE 11th Interna- tional Conference on Malicious and Unwanted So/f_tware, MALW ARE 2016, Fa- jardo, PR, USA, October 18-21, 2016 . IEEE Computer S...

    2016

  16. [24]

    David Korczynski. 2019. Precise system-wide concatic malware unpacking. arXiv e-prints , Article arXiv:1908.09204 (Aug 2019), arXiv:1908.09204 pages. arXiv:cs.CR/1908.09204

    2019 arXiv

  17. [25]

    David Korczynski and Heng Yin. 2017. Capturing Malware Propagations with Code Injections and Code-Reuse A/t_tacks. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 , Bhavani M. /T...

    2017

  18. [26]

    PaloAlto Networks. 2013. /T_he Modern Malware Review

    2013

  19. [27]

    Giulio De Pasquale. 2017. h/t_tps://github.com/peperunas/injectopi

    2017

  20. [28]

    Daniel Plohmann, Martin Clauß, and Elmar Padilla. 2017. Malpedia: A Collabo- rative Effort to Inventorize the Malware Landscape. /T_he Journal on Cybercrime & Digital Investigations 3, 1 (2017), 1–19. h/t_tps://doi.org/10.18464/cybin.v3i1.17

    2017 doi

  21. [29]

    Georgios Portokalidis, Asia Slowinska, and Herbert Bos. 2006. Argos: an Emula- tor for Fingerprinting Zero-Day A/t_tacks. InProc. ACM SIGOPS EUROSYS’2006. Leuven, Belgium

    2006

  22. [30]

    Marcos Sebasti ´an, Richard Rivera, Platon Kotzias, and Juan Caballero. 2016. AVclass: A Tool for Massive Malware Labeling. InResearch in A/t_tacks, Intrusions, and Defenses, Fabian Monrose, Marc Dacier, Gregory Blanc, and Joaquin Garcia- Alfaro (Eds.). Springer International ...

    2016

  23. [31]

    Giorgio Severi, Tim Leek, and Brendan Dolan-Gavi/t_t. 2018. Malrec: Compact Full-Trace Malware Recording for Retrospective Deep Analysis. In Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMV A 2018, Saclay, France, June 28-...

    2018 doi

  24. [32]

    Kimberly Tam, Ali Feizollah, Nor Badrul Anuar, Rosli Salleh, and Lorenzo Caval- laro. 2017. /T_he Evolution of Android Malware and Android Analysis Techniques. ACM Comput. Surv. 49, 4 (2017), 76:1–76:41. h/t_tps://doi.org/10.1145/3017427

    2017 doi

  25. [33]

    Xabier Ugarte-pedrero, Davide Balzaro/t_ti, Igor Santos, and Pablo G. Bringas. [n.d.]. SoK: Deep Packer Inspection: A Longitudinal Study of the Complexity of 16 Run-Time Packers

  26. [34]

    Fengguo Wei, Yuping Li, Sankardas Roy, Xinming Ou, and Wu Zhou. 2017. Deep Ground Truth Analysis of Current Android Malware. In Detection of Intrusions and Malware, and Vulnerability Assessment , Michalis Polychronakis and Michael Meier (Eds.). Springer International Publishin...

    2017

  27. [35]

    Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda

  28. [36]

    Yajin Zhou and Xuxian Jiang. 2012. Dissecting Android Malware: Character- ization and Evolution. In Proceedings of the 2012 IEEE Symposium on Security and Privacy (SP ’12). IEEE Computer Society, Washington, DC, USA, 95–109. h/t_tps://doi.org/10.1109/SP.2012.16 A DATA TABLES 1...

    2012 doi

  29. [2007]

    In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS ’07)

    Panorama: Capturing System-wide Information Flow for Malware De- tection and Analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS ’07) . ACM, New York, NY, USA, 116–127. h/t_tps://doi.org/10.1145/1315245.1315261

  30. [2015]

    In Proceedings of the 5th Program Protection and Reverse Engineering Workshop (PPREW-5)

    Repeatable Reverse Engineering with PANDA. In Proceedings of the 5th Program Protection and Reverse Engineering Workshop (PPREW-5) . ACM, New York, NY, USA, Article 4, 11 pages. h/t_tps://doi.org/10.1145/2843859.2843867

  31. [2018]

    In S&P 2018, 39th IEEE Symposium on Security and Privacy, May 21-23, 2018, San Francisco, CA, USA

    Understanding Linux malware. In S&P 2018, 39th IEEE Symposium on Security and Privacy, May 21-23, 2018, San Francisco, CA, USA . San Francisco, UNITED STATES. h/t_tp://www.eurecom.fr/publication/5489

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.