MITRE ATT&CKsub-technique

T1027.001 Binary Padding

Published 2020-02-05 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-02-05

Description

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures. The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware. Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (31)

  • S9050 Vidar software (malware)
  • S9016 Caminho software (malware)
  • S9018 HeartCrypt software (malware)
  • S1239 TONESHELL software (malware)
  • S1185 LightSpy software (malware)
  • S1160 Latrodectus software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • G1024 Akira group
  • S1086 Snip3 software (malware)
  • S1070 Black Basta software (malware)
  • S0650 QakBot software (malware)
  • S0632 GrimAgent software (malware)
  • S0614 CostaBricks software (malware)
  • G0126 Higaisa group
  • S0586 TAINTEDSCRIBE software (malware)
  • S0531 Grandoreiro software (malware)
  • S0528 Javali software (malware)
  • S0477 Goopy software (malware)
  • S0433 Rifdoor software (malware)
  • G0094 Kimsuky group
  • S0367 Emotet software (malware)
  • S0236 Kwampirs software (malware)
  • S0244 Comnie software (malware)
  • S0268 Bisonal software (malware)
  • G0065 Leviathan group
  • G0060 BRONZE BUTLER group
  • G0002 Moafee group
  • G0016 APT29 group
  • G0040 Patchwork group
  • S0013 PlugX software (malware)
Show all 31 ›

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-572 Artificially Inflate File Sizes attack pattern
  • CAPEC-655 Avoid Security Tool Identification by Adding Data attack pattern

References