SoK: Use of Cryptography in Malware Obfuscation. (arXiv:2212.04008v1 [cs.CR])

We look at the use of cryptography to obfuscate malware. Most surveys on
malware obfuscation only discuss simple encryption techniques (e.g., XOR
encryption), which are easy to defeat (in principle), since the decryption
algorithm and the key is shipped within the program. This SoK proposes a
principled definition of malware obfuscation, and categorises instances of
malware obfuscation that use cryptographic tools into those which evade
detection and those which are detectable. The SoK first examines easily
detectable schemes such as …

cryptography malware obfuscation