Detecting Cryptographic Functions for String Obfuscation

Analysing complex evasion and obfuscation techniques is crucial for creating more robust defences against malware. String obfuscation is an easy-to-implement technique that hides information, such as domain names, registry keys, etc. Its detection and removal allow malware to be more accurately analysed. This paper proposes a new method for generating detectors for string obfuscation in binary executables. This is achieved by combining features extracted from the assembly of a binary, and its respective control flow graph and the directed graph derived from the control flow graph. Our method generates highly efficient detectors tailored for string obfuscation achieving more than 90% across all evaluation metrics.