Difference between revisions of "Ema-1105"

From ema
Jump to navigation Jump to search
m (Text replacement - "|Associated Behavior=ema-" to "|Associated Behavior=Ema-")
m (Text replacement - "|Experimental=No " to "")
 
Line 6: Line 6:
 
|URL=http://unprotect.tdgt.org/index.php/Anti-disassembly
 
|URL=http://unprotect.tdgt.org/index.php/Anti-disassembly
 
}}
 
}}
|Experimental=No
 
 
}}
 
}}

Latest revision as of 18:07, 7 July 2017

EMA ID: ema-1105
Description: Flattening the control flow of each function by first breaking up the nesting of loops and if-statements, and then hiding each of them in a case of a large switch statement, that is wrapped inside the body of a loop.
Associated Behavior: linear disassembler prevention


References:
Date Malware Family URL
http://unprotect.tdgt.org/index.php/Anti-disassembly