Page values for "Ema-1091"
Jump to navigation
Jump to search
"Associations" values
Association_Type | Behavior |
Associated_Page | virtual machine detect & evade |
"Behavior_Instances" values
Associated_Behavior | virtual machine detect & evade |
"Pages" values
Name | HTML5 Performance Object |
Title_Icon | BehaviorInstance-Windows.png |
Description | In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines. |
"References" values
Reference_Date | 2015-05-10 |
Malware_Family | |
Reference_URL | http://www.securitygalore.com/site3/vmd1-advisory |