67 lines
1.6 KiB
JSON
67 lines
1.6 KiB
JSON
{
|
|
"namespace": "maec-malware-obfuscation-methods",
|
|
"description": "Obfuscation methods used by malware based on MAEC 5.0",
|
|
"version": 1,
|
|
"predicates": [
|
|
{
|
|
"value": "maec-obfuscation-methods",
|
|
"expanded": "MAEC Obfuscation methods"
|
|
}
|
|
],
|
|
"values": [
|
|
{
|
|
"predicate": "maec-obfuscation-methods",
|
|
"entry": [
|
|
{
|
|
"value": "packing",
|
|
"expanded": "packing"
|
|
},
|
|
{
|
|
"value": "code-encryption",
|
|
"expanded": "code-encryption"
|
|
},
|
|
{
|
|
"value": "dead-code-insertion",
|
|
"expanded": "dead-code-insertion"
|
|
},
|
|
{
|
|
"value": "entry-point-obfuscation",
|
|
"expanded": "entry-point-obfuscation"
|
|
},
|
|
{
|
|
"value": "import-address-table-obfuscation",
|
|
"expanded": "import-address-table-obfuscation"
|
|
},
|
|
{
|
|
"value": "interleaving-code",
|
|
"expanded": "interleaving-code"
|
|
},
|
|
{
|
|
"value": "symbolic-obfuscation",
|
|
"expanded": "symbolic-obfuscation"
|
|
},
|
|
{
|
|
"value": "string-obfuscation",
|
|
"expanded": "string-obfuscation"
|
|
},
|
|
{
|
|
"value": "subroutine-reordering",
|
|
"expanded": "subroutine-reordering"
|
|
},
|
|
{
|
|
"value": "code-transposition",
|
|
"expanded": "code-transposition"
|
|
},
|
|
{
|
|
"value": "instruction-substitution",
|
|
"expanded": "instruction-substitution"
|
|
},
|
|
{
|
|
"value": "register-reassignment",
|
|
"expanded": "register-reassignment"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|