Malware Analysis Reveals Persistent Popularity of 32-bit PE Files and Compiler Obscurity
A deep dive into 23.5 million malicious files from Malware Bazaar highlights the continued prevalence of 32-bit Portable Executable (PE) files and significant challenges in identifying their origins.
A recent analysis of over 23.5 million files sourced from Malware Bazaar has shed light on the persistent popularity of 32-bit Portable Executable (PE) files in the malware landscape. The researcher, using a Python script leveraging the pefile library, extracted metadata from PE headers to identify compiler and linker statistics, confirming previous findings that 32-bit binaries remain a significant portion of malicious software. This trend persists despite the widespread adoption of 64-bit architectures.
The analysis employed several techniques to identify the tools used in malware creation. The "Rich Header," a block of data embedded by the Microsoft linker, proved valuable for fingerprinting specific MSVC compiler and linker builds. For .NET binaries, the CLR header provided runtime and metadata versions. Additionally, a heuristic string scan was used to detect signatures from non-Microsoft toolchains like GCC, Clang, Delphi, Go, and Rust, as these often lack a Rich Header.
However, the study also highlighted a significant challenge: attribution. A substantial 39.4% of the analyzed malicious PE files were ultimately unidentified. This lack of clear attribution stems from various factors, including the potential for metadata tampering, the use of non-Microsoft toolchains, or the deliberate stripping of identifying information from the binaries. This obscurity makes it harder for security researchers to cluster samples and attribute them to specific threat actor groups or campaigns.
Among the identified samples, specific linker versions and MSVC compiler builds appeared with notable frequency. Linker version 48.0 was the most common, followed by versions 6.0 and 9.0. For MSVC compiler builds, 'build 26213' was the most frequently observed, indicating a popular development environment among malware authors. These specific build fingerprints can be crucial for forensic analysis and threat intelligence.
The research also noted the relatively low adoption of emerging programming languages like Go and Rust in the analyzed malware dataset. While these languages offer advantages for systems programming and cross-platform development, their presence in malicious executables was found to be exotic, with Go appearing in 6,254 samples and Rust in only 1,329 out of the millions analyzed. This suggests that traditional C/C++ toolchains, particularly Microsoft's Visual C/C++, remain the dominant choice for malware development.
The findings underscore the ongoing cat-and-mouse game between malware authors and security defenders. While sophisticated techniques for obfuscation and evasion are constantly evolving, the fundamental choices in development tools and architectures provide valuable insights into the threat landscape. The continued reliance on older, 32-bit architectures and the prevalence of specific compiler builds offer potential avenues for detection and analysis, even when direct attribution is challenging.
This research, conducted by analyzing a massive dataset from Malware Bazaar, provides a valuable snapshot of the current state of malware development tools. The persistence of 32-bit PE files and the significant percentage of unidentified samples emphasize the need for robust analysis techniques that can overcome obfuscation and attribution challenges in the ongoing fight against cyber threats.