REVERSE ENGINEERING AND JAVA VIRAL ANALYSIS
Daniel Reynaud-Plantey · 2005
Reverse engineers play an important role in the fight against worms, viruses and more generally malware. Viral techniques and their countermeasures have been studied for years, but this is not the case in the ever-growing Java community. For the moment, there have been no Java viruses in the wild and the few malicious applets have been using little or no protection. If an armoured Java virus was to be released nowadays, the response teams and analysts would certainly be surprised by such techniques. This article presents some techniques that Java malicious programs might use to prevent or delay the analysis of their own code. These protections can operate at different levels, from the distribution and encapsulation of the code to the lowest-level bytecode obfuscation. Each time, workarounds will be proposed in order to build a Java viral analysis methodology.