Hot Knives Through Butter: Bypassing File-based Sandboxes

From 2008 paper "Towards an Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware":

 

Some malware is using stalling code to evade dynamic analysis.

 

Figure 6 from paper "The Threat of Evasive Malware"

Code:

PDF download http://lastline.com/papers/evasive_threats.pdf

indicates that the percentage of malware samples exhibiting evasive behavior increased from ~25% to ~29% from the beginning of 2012 to the end of 2012.