Anti-Analysis Techniques Covered by the malware-analysis Skill: 9 Categories and 94 Detection Methods

The malware-analysis skill covers 94 distinct anti-analysis techniques organized into 9 major categories, including timer-based evasion, CPU fingerprinting, firmware checks, hardware fingerprinting, API hook enumeration, process detection, file-system analysis, registry inspection, and window detection.

The zhaoxuya520/reverse-skill repository provides a comprehensive catalogue of anti-analysis detection methods designed to identify evasive behaviors in Windows-based malware. This skill empowers AI agents and security researchers to systematically detect VM-aware, sandbox-aware, and debugger-aware malware through both static and dynamic analysis techniques.

The 9 Categories of Anti-Analysis Techniques

The reference file [skills/malware-analysis/references/anti-analysis-techniques.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md) organizes all 94 techniques into these functional groups:

1. Timers and Sleep-Based Checks

Malware uses extended sleep periods to outlast short-running sandboxes. Common implementations include:

• Sleep(300000) — 5-minute delays to trigger sandbox timeouts
• NtDelayExecution — native API for fine-grained timing control
• GetTickCount loops — polling-based delay detection
• SetTimer callbacks — asynchronous timer callbacks

YARA detectability: Low. These patterns require dynamic analysis since timing calls appear legitimate in static analysis.

2. CPU Fingerprinting

Techniques that query processor identifiers to detect virtualized environments:

• CPUID string signatures ("VMwareVMware", "VBoxVBoxVBox")
• Core count validation (detecting < 2 physical cores)
• VT-x presence checks for nested virtualization

YARA detectability: Medium. Static CPUID patterns and string literals can be signatured.

3. Firmware and BIOS Checks

Reading SMBIOS/ACPI tables for VM vendor artifacts:

Manufacturer: "VMware, Inc."
Product:      "VirtualBox"
Serial:       "0"

YARA detectability: High. String literals embedded in binaries provide reliable static indicators.

4. Hardware Fingerprinting

Examining device-specific identifiers:

• MAC address OUIs: 00:0C:29 (VMware), 08:00:27 (VirtualBox)
• Disk serial numbers: VM-allocated identifiers
• Graphics adapter names: Generic VM display drivers

5. API Hook Enumeration

Detecting altered system-call stubs or runtime library modifications:

• Comparing on-disk ntdll.dll versus in-memory version
• LoadLibrary signature mismatch detection
• Inline hook validation through return-address integrity checks

6. Process Detection

Searching for known analysis tools and sandbox agents:

Target Type	Example Processes
Network analyzers	wireshark.exe, Fiddler.exe
System monitors	procmon.exe, procexp.exe
Dynamic instrumentation	frida-server, reaper.exe
VM services	VBoxTray.exe, vmware-tray.exe

YARA detectability: High. Process-name strings resident in memory provide strong indicators.

7. File-System Checks

Scanning for VM-specific paths and device names:

C:\Program Files\VMware\
C:\Program Files\Oracle\VirtualBox Guest Additions\
\\.\VBoxMiniRdrDN

YARA detectability: High. Static path strings appear unencrypted in most malware samples.

8. Registry Checks

Reading configuration keys that reveal virtual environments:

• HKLM\SOFTWARE\VMware, Inc.\VMware Tools
• HKLM\HARDWARE\ACPI\DSDT\VBOX__
• HKLM\SYSTEM\CurrentControlSet\Enum\SCSI (virtual disk identifiers)

YARA detectability: High.

9. Window Detection

Enumerating window titles of debuggers and analysis UI:

• "x64dbg"
• "OllyDbg"
• "Process Hacker"
• "Ghidra:" (project window titles)

YARA detectability: High.

Advanced Anti-Analysis Tactics

Beyond the baseline categories, the catalogue documents sophisticated evasion methods:

Timed Escape Detection

Measuring real-time versus accelerated clock to detect time-skipping sandboxes:

# Detect time acceleration in sandboxes

$freq = [System.Diagnostics.Stopwatch]::Frequency
$start = [System.Diagnostics.Stopwatch]::GetTimestamp()
Start-Sleep -Milliseconds 1000
$end = [System.Diagnostics.Stopwatch]::GetTimestamp()
$elapsed = ($end - $start) / $freq
if ($elapsed -ne 1.0) {
    Write-Host "Time acceleration detected – possible sandbox"
}

This technique uses QueryPerformanceCounter to validate that wall-clock time matches CPU cycle counts.

Exception-Based Checks

Triggering faults to test EDR interception:

__try {
    volatile int zero = 0;
    volatile int crash = 1 / zero;   // Force divide-by-zero
}
__except(EXCEPTION_EXECUTE_HANDLER) {
    // If reached normally, no EDR hook intercepted
    ExitProcess(0);
}

Malware expects vectored exception handlers to modify execution flow; absence indicates hooked analysis.

Return-Address Integrity

Validating caller context after system calls to catch inline hook tampering—a technique particularly effective against user-mode API monitoring tools.

YARA Rules and Detection Pipeline

The malware-analysis skill includes 42 high-precision YARA rules (≥75% accuracy) targeting the most reliable detection categories:

• Firmware/BIOS checks
• Process detection
• File-system checks
• Registry checks
• Window detection

Example rule for VM BIOS strings:

rule VM_BIOS_Fingerprint {
    meta:
        description = "Detects virtual BIOS strings indicative of VMs"
        author = "reverse-skill"
        reference = "anti-analysis-techniques.md"
    strings:
        $vmware = "VMware, Inc."
        $vbox   = "VirtualBox"
        $qemu   = "QEMU"
    condition:
        any of ($vmware, $vbox, $qemu)
}

Integration with AI-Agent Workflows

The anti-analysis catalogue integrates with the malware-analysis SKILL definition in [skills/malware-analysis/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md). When detections fire, the skill triggers response workflows documented in:

• [skills/reverse-engineering/anti-analysis.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md) — Agent response recipes
• [skills/reverse-engineering/references/re-agent-workflow.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/re-agent-workflow.md) — Coordination workflows

The recommended layered detection pipeline follows this sequence:

1. Static YARA scanning
2. Dynamic behavioral monitoring
3. Signature-based verification

Summary

• The malware-analysis skill catalogues 94 anti-analysis techniques across 9 major categories for Windows malware detection.
• 42 YARA rules provide ≥75% accuracy for static detection of firmware, process, file-system, registry, and window indicators.
• Advanced tactics include timed escape detection, exception-based EDR testing, and return-address integrity validation.
• All techniques are documented in [anti-analysis-techniques.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md) and integrated with AI-agent workflows via SKILL.md definitions.
• The recommended detection pipeline combines static YARA scanning with dynamic monitoring and signature verification.

Frequently Asked Questions

What file contains the complete list of anti-analysis techniques?

The complete catalogue resides in [skills/malware-analysis/references/anti-analysis-techniques.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md). This file documents all 94 techniques, 9 categories, YARA rules, and best-practice guidance for detection pipelines.

Which anti-analysis categories have the highest YARA detectability?

Firmware/BIOS checks, process detection, file-system checks, registry checks, and window detection yield high YARA detectability due to static string literals in binaries. Timer-based and API hook enumeration techniques require dynamic analysis for reliable detection.

How does the malware-analysis skill respond when anti-analysis behavior is detected?

Detection triggers an agent response workflow defined in [skills/reverse-engineering/anti-analysis.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/anti-analysis.md). The SKILL.md definition instructs the AI agent to classify the evasion technique and execute appropriate countermeasures through the coordinated workflow in re-agent-workflow.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}