Page values for "Ema-1091"

Jump to: navigation, search

"Associations" values

Association_TypeBehavior
Associated_Pagevirtual machine detect & evade

"Behavior_Instances" values

Associated_Behaviorvirtual machine detect & evade

"Pages" values

NameHTML5 Performance Object
Title_IconBehaviorInstance-Windows.png
Description
In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.

"References" values

Reference_Date2015-05-10
Malware_Family
Reference_URLhttp://www.securitygalore.com/site3/vmd1-advisory