Encrypted data identification

One of the main features of antivirus software is to detect malware using signatures. Signatures are sets of byte sequences unique to a given piece of malware. Although this detection technique is not thought of as effective for anti-virus nowadays, it may still play a vital role in detecting files, especially when an operating system is taken offline.

Simple signature detection can easily be defeated by encrypting the data and/or code of a malware. The effect would be that a new signature gets developed from a unique portion of the encrypted data. An attacker can simply re-encrypt the same malware using a different key, which would result in another signature. But still, the malware runs with the same behavior.

Of course, anti-virus software has made great improvements to defeat this technique, thereby making signature detection a technology of the past.

On the other hand, this is an obfuscation technique that eats up additional time for reversing software. Under...