A study on instruction substitution analysis of metamorphic malware

Abstract

Recent malware authors generate lots of malware variants using malware toolkits. Also, the malware has been generated using various techniques for avoiding detection by anti-virus software. In particular, metamorphic malware avoids such detection in anti-virus software by modifying codes automatically including a metamorphic engine as such malware is propagated. In this paper, an analysis of instruction substitution for metamorphic malware is performed and an instruction substitution rule is presented.