Lion Cipher Lab
See through polymorphism: why two different-looking files are the same malware
- Digital Forensics & IR (DFIR)
- Advanced
- ~45 min
- Free · no account required
Why it matters
A blue team that blocks malware by file hash is playing a game it cannot win. A packer wraps the real program in a randomized outer layer, so the attacker rebuilds the same malware a thousand times and gets a thousand different SHA-256 hashes and section layouts — every one sails past a hash blocklist and past static signatures tuned to the wrapper. This is one of the most common evasions in the wild, catalogued by MITRE as Software Packing (T1027.002). The skill that beats it is knowing where the malware's DURABLE identity actually lives: not in the mutating file on disk, but in the unpacked…
What you'll learn
- reading a packed sample's static profile: high entropy + a two-function stub import table
- recognising why two files with different SHA-256 hashes can be the exact same malware
- explaining why file hashes and static signatures fail against packing and polymorphism
- reading a memory dump of the unpacked payload: normal entropy, full imports, real strings
- identifying the invariant (unpacked code, resolved imports, C2) that survives repacking
- pivoting detection from file hashes to YARA-on-memory and C2/behavioural IOCs
- mapping the behaviour to MITRE ATT&CK T1027 and T1027.002 (Software Packing)
- judgment: WHEN static hashing wins, WHEN it fails, and how a pro signatures the payload not the wrapper
Steps in this lab
- The paradox: two different files, one malware
- WHEN static hashing and signatures win — and WHEN they fail (the third rule)
- The setting: two invented samples in your isolated lab
- BEFORE — read the two files as they sit on disk
- The stub import table — the second, decisive tell
- AFTER — dump the unpacked payload from memory
- The invariant: signature the payload, not the wrapper
- The limits: what this analysis does NOT prove, and how a pro stays honest
- Recap: the decision you can now make