While not directly related to our manual analysis, automated analysis tools such as anti-malware software and intrusion detection and prevention systems have historically relied on signatures for their detection engines. A signature, in the case of a binary, may be anything from a series of bytes in a certain order to a series of specific bytes found at a specific offset within the file. Whether the bytes represent a string within the binary or a series of assembly opcodes, signatures have long been the method of detecting malicious functionality within a binary.
It used to be a cat and mouse game between antivirus vendors and malware authors as each would try to outsmart the other. The industry itself is beginning to see smarter technology emerge that attempts to identify malicious software using different techniques besides relying solely on...
