Non-normalizable functions: A new method to generate metamorphic malware

To successfully identify the metamorphic viruses oriented from the same base, anti-virus software has adopted the code normalization technique to transform the variations to a more uniform signature representation. Current code normalization technique focuses on the simplification of the arithmetical or logical operators. In this paper, we introduce a new technique of generating metamorphic viruses by embedding complicated manipulation functions that cannot be normalized into the malicious executables. Using encryption/decryption functions as an example, we present this evasion strategy that malware writers could employ in the future. We demonstrate the strategy's effectiveness in evading detection by current anti-virus technologies. We also discuss the potential mitigation mechanisms.