Entry Point Modification

Created the Monday 18 March 2019. Updated 2 months ago.

The entry point is the starting point of an executable file during execution. Some malware use techniques such as changing or relocating the real entry point to protect their code from analysis. This makes it difficult for security software to identify and detect the malware as the code is not executed in the usual way.

Technique Identifier

U1228

Technique Tags

entry point executable file execution malware techniques changing relocating real entry point protect code analysis security software identification

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Expiro Infects, Encrypts Files to Complicate Repair