# Anti-Analysis Techniques Covered by the malware-analysis Skill: 9 Categories and 94 Detection Methods

> Discover 94 anti-analysis techniques across 9 categories like timer evasion, fingerprinting, and API hooks covered by the malware-analysis skill. Enhance your threat detection capabilities.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-20

---

**The malware-analysis skill covers 94 distinct anti-analysis techniques organized into 9 major categories, including timer-based evasion, CPU fingerprinting, firmware checks, hardware fingerprinting, API hook enumeration, process detection, file-system analysis, registry inspection, and window detection.**

The `zhaoxuya520/reverse-skill` repository provides a comprehensive catalogue of anti-analysis detection methods designed to identify evasive behaviors in Windows-based malware. This skill empowers AI agents and security researchers to systematically detect VM-aware, sandbox-aware, and debugger-aware malware through both static and dynamic analysis techniques.

## The 9 Categories of Anti-Analysis Techniques

The reference file [[`skills/malware-analysis/references/anti-analysis-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md) organizes all 94 techniques into these functional groups:

### 1. Timers and Sleep-Based Checks

Malware uses extended sleep periods to outlast short-running sandboxes. Common implementations include:

- `Sleep(300000)` — 5-minute delays to trigger sandbox timeouts
- `NtDelayExecution` — native API for fine-grained timing control
- `GetTickCount` loops — polling-based delay detection
- `SetTimer` callbacks — asynchronous timer callbacks

**YARA detectability:** Low. These patterns require dynamic analysis since timing calls appear legitimate in static analysis.

### 2. CPU Fingerprinting

Techniques that query processor identifiers to detect virtualized environments:

- `CPUID` string signatures ("VMwareVMware", "VBoxVBoxVBox")
- Core count validation (detecting < 2 physical cores)
- VT-x presence checks for nested virtualization

**YARA detectability:** Medium. Static `CPUID` patterns and string literals can be signatured.

### 3. Firmware and BIOS Checks

Reading SMBIOS/ACPI tables for VM vendor artifacts:

```

Manufacturer: "VMware, Inc."
Product:      "VirtualBox"
Serial:       "0"

```

**YARA detectability:** High. String literals embedded in binaries provide reliable static indicators.

### 4. Hardware Fingerprinting

Examining device-specific identifiers:

- **MAC address OUIs:** `00:0C:29` (VMware), `08:00:27` (VirtualBox)
- **Disk serial numbers:** VM-allocated identifiers
- **Graphics adapter names:** Generic VM display drivers

### 5. API Hook Enumeration

Detecting altered system-call stubs or runtime library modifications:

- Comparing on-disk `ntdll.dll` versus in-memory version
- `LoadLibrary` signature mismatch detection
- Inline hook validation through return-address integrity checks

### 6. Process Detection

Searching for known analysis tools and sandbox agents:

| Target Type | Example Processes |
|-------------|-----------------|
| Network analyzers | `wireshark.exe`, `Fiddler.exe` |
| System monitors | `procmon.exe`, `procexp.exe` |
| Dynamic instrumentation | `frida-server`, `reaper.exe` |
| VM services | `VBoxTray.exe`, `vmware-tray.exe` |

**YARA detectability:** High. Process-name strings resident in memory provide strong indicators.

### 7. File-System Checks

Scanning for VM-specific paths and device names:

```

C:\Program Files\VMware\
C:\Program Files\Oracle\VirtualBox Guest Additions\
\\.\VBoxMiniRdrDN

```

**YARA detectability:** High. Static path strings appear unencrypted in most malware samples.

### 8. Registry Checks

Reading configuration keys that reveal virtual environments:

- `HKLM\SOFTWARE\VMware, Inc.\VMware Tools`
- `HKLM\HARDWARE\ACPI\DSDT\VBOX__`
- `HKLM\SYSTEM\CurrentControlSet\Enum\SCSI` (virtual disk identifiers)

**YARA detectability:** High.

### 9. Window Detection

Enumerating window titles of debuggers and analysis UI:

- `"x64dbg"`
- `"OllyDbg"`
- `"Process Hacker"`
- `"Ghidra:"` (project window titles)

**YARA detectability:** High.

## Advanced Anti-Analysis Tactics

Beyond the baseline categories, the catalogue documents sophisticated evasion methods:

### Timed Escape Detection

Measuring real-time versus accelerated clock to detect time-skipping sandboxes:

```powershell

# Detect time acceleration in sandboxes

$freq = [System.Diagnostics.Stopwatch]::Frequency
$start = [System.Diagnostics.Stopwatch]::GetTimestamp()
Start-Sleep -Milliseconds 1000
$end = [System.Diagnostics.Stopwatch]::GetTimestamp()
$elapsed = ($end - $start) / $freq
if ($elapsed -ne 1.0) {
    Write-Host "Time acceleration detected – possible sandbox"
}

```

This technique uses `QueryPerformanceCounter` to validate that wall-clock time matches CPU cycle counts.

### Exception-Based Checks

Triggering faults to test EDR interception:

```c
__try {
    volatile int zero = 0;
    volatile int crash = 1 / zero;   // Force divide-by-zero
}
__except(EXCEPTION_EXECUTE_HANDLER) {
    // If reached normally, no EDR hook intercepted
    ExitProcess(0);
}

```

Malware expects vectored exception handlers to modify execution flow; absence indicates hooked analysis.

### Return-Address Integrity

Validating caller context after system calls to catch inline hook tampering—a technique particularly effective against user-mode API monitoring tools.

## YARA Rules and Detection Pipeline

The malware-analysis skill includes **42 high-precision YARA rules** (≥75% accuracy) targeting the most reliable detection categories:

- Firmware/BIOS checks
- Process detection
- File-system checks
- Registry checks
- Window detection

Example rule for VM BIOS strings:

```yaml
rule VM_BIOS_Fingerprint {
    meta:
        description = "Detects virtual BIOS strings indicative of VMs"
        author = "reverse-skill"
        reference = "anti-analysis-techniques.md"
    strings:
        $vmware = "VMware, Inc."
        $vbox   = "VirtualBox"
        $qemu   = "QEMU"
    condition:
        any of ($vmware, $vbox, $qemu)
}

```

## Integration with AI-Agent Workflows

The anti-analysis catalogue integrates with the **malware-analysis SKILL definition** in [[`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md). When detections fire, the skill triggers response workflows documented in:

- [[`skills/reverse-engineering/anti-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md) — Agent response recipes
- [[`skills/reverse-engineering/references/re-agent-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/re-agent-workflow.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/re-agent-workflow.md) — Coordination workflows

The recommended **layered detection pipeline** follows this sequence:

1. Static YARA scanning
2. Dynamic behavioral monitoring
3. Signature-based verification

## Summary

- The malware-analysis skill catalogues **94 anti-analysis techniques** across **9 major categories** for Windows malware detection.
- **42 YARA rules** provide ≥75% accuracy for static detection of firmware, process, file-system, registry, and window indicators.
- Advanced tactics include **timed escape detection**, **exception-based EDR testing**, and **return-address integrity validation**.
- All techniques are documented in [[`anti-analysis-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/anti-analysis-techniques.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md) and integrated with AI-agent workflows via SKILL.md definitions.
- The recommended detection pipeline combines static YARA scanning with dynamic monitoring and signature verification.

## Frequently Asked Questions

### What file contains the complete list of anti-analysis techniques?

The complete catalogue resides in [[`skills/malware-analysis/references/anti-analysis-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md). This file documents all 94 techniques, 9 categories, YARA rules, and best-practice guidance for detection pipelines.

### Which anti-analysis categories have the highest YARA detectability?

**Firmware/BIOS checks, process detection, file-system checks, registry checks, and window detection** yield high YARA detectability due to static string literals in binaries. Timer-based and API hook enumeration techniques require dynamic analysis for reliable detection.

### How does the malware-analysis skill respond when anti-analysis behavior is detected?

Detection triggers an **agent response workflow** defined in [[`skills/reverse-engineering/anti-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md). The SKILL.md definition instructs the AI agent to classify the evasion technique and execute appropriate countermeasures through the coordinated workflow in [`re-agent-workflow.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/re-agent-workflow.md).