>I take 1000 samples and look what doesn't change to make a signature.

There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.

> There's fully metamorphic viruses where even the code mutating part is changed. Algorithmically it's equivalent but there's no "static" portion of the virus.

Never seen it play out that way. There's always something in practice. See you just talked about randomizing the code. But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons.

In theory it's easy to not have anything static, in practice, that's the cat and mouse game you're playing.

Look into Mistfall. It would infect other executables by splitting them into basic blocks that end with some branching instruction and inserting metamorphic portions of itself in between blocks and fixing up all of the modified addresses. There literally isn't any "static" portion. Here's a mirror of the author's site, he is Russian but there's a ton of English translations and articles that are a great read.

http://z0mbie.daemonlab.org/

> But a windows PE isn't just code. It also has an icon. And yes i've seen AVs detect specific icons.

And that's how you get overzealous AVs marking executables because they happen to have PE headers...

Why not both? Trivial change (like embedded timestamp in a file) for every user, and advanced polymorphism for the times when the malware is detected.

I bet most researchers have tools to bin files together automatically based on the same MD5. Why make their life easier when this is so easy to defeat?

Because many AV systems assume that any unknown file (unknown to their cloud service) is probably doing this, and thus probably malware.