H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Binary Padding

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)

34 recorded

Relationships

mapped-to
from Artificially Inflate File Sizes
Technique
mapped-to
from Avoid Security Tool Identification by Adding Data
Technique
revoked-by
from Binary Padding
Technique
subtechnique-of
to Obfuscated Files or Information
Technique
uses
from Akira
Group
uses
from APT29
Group
uses
from Bisonal
Malware
uses
from Black Basta
Malware
uses
from BRONZE BUTLER
Group
uses
from Caminho
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from Comnie
Malware
uses
from CostaBricks
Malware
uses
from Emissary
Malware
uses
from Emotet
Malware
uses
from Goopy
Malware
uses
from Grandoreiro
Malware
uses
from GrimAgent
Malware
uses
from HeartCrypt
Malware
uses
from Higaisa
Group
uses
from Javali
Malware
uses
from Kimsuky
Group
uses
from Kwampirs
Malware
uses
from Latrodectus
Malware
uses
from Leviathan
Group
uses
from LightSpy
Malware
uses
from Moafee
Group
uses
from Patchwork
Group
uses
from PlugX
Malware
uses
from QakBot
Malware
uses
from Rifdoor
Malware
uses
from Snip3
Malware
uses
from TAINTEDSCRIBE
Malware
uses
from TONESHELL
Malware
4 external

References

mitre-attack
T1027.001
open
ESET OceanLotus
https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
open
Securelist Malware Tricks April 2017
https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/
open
VirusTotal FAQ
https://www.virustotal.com/en/faq/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance