Advanced transcriptase for JavaScript malware
Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, Mark Stamp · 2016
Previous work has shown that JavaScript malware can manipulate its internal code with relative ease using an approach known as Transcriptase. However, the resulting malware remained susceptible to software similarity based scoring techniques. In this research, we develop and analyze an advanced version of Transcriptase that is entirely practical and is not detectable using any of several scoring techniques considered. Our technique, which is based on entropy manipulations and multiple layers of encryption, is applicable generally for use in malware obfuscation.