Analysis and development of polyglot files
Polyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesse...
| Author: | |
|---|---|
| Format: | Master's thesis |
| Publication date: | 2025 |
| Country: | España |
| Institution: | Universitat Politècnica de Catalunya (UPC) |
| Repository: | UPCommons. Portal del coneixement obert de la UPC |
| Language: | English |
| OAI Identifier: | oai:upcommons.upc.edu:2117/451931 |
| Online Access: | https://hdl.handle.net/2117/451931 |
| Access Level: | Open access |
| Keyword: | Malware (Computer software) Cybersecurity Malware Polyglot Programari maliciós Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica |
| _version_ | 1878732578995830784 |
|---|---|
| author | Gonzalez Valdes, Paul |
| author_browse | Gonzalez Valdes, Paul |
| author_facet | Gonzalez Valdes, Paul |
| author_role | author |
| collection | UPCommons. Portal del coneixement obert de la UPC |
| description | Polyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesses of various formats that allow malicious code to be inserted by exploiting headers, end of files, and internal fields such as comment spaces. The cases studied confirm that polyglots have already been used in advanced campaigns, such as the Pegasus spyware, and highlight their role in the initial delivery of malware within more complex attack chains. Tests show that while signature-based antivirus software can detect some polyglots, others can evade antivirus engines and sandboxes, revealing significant gaps in current detection systems. In conclusion, polyglot files are a real and effective threat, especially when combined with advanced evasion techniques. Detecting them requires a more detailed analysis of file structures and new defensive strategies to counter increasingly stealthy and intelligent attack tactics. |
| eu_rights_str_mv | openAccess |
| format | masterThesis |
| id | ES_45b50df276dff646aa5ecee01ac9cf68 |
| institution | Universitat Politècnica de Catalunya (UPC) |
| instname_str | Universitat Politècnica de Catalunya (UPC) |
| language | eng |
| network_acronym_str | ES |
| network_name_str | España |
| oai_identifier_str | oai:upcommons.upc.edu:2117/451931 |
| publishDate | 2025 |
| publishDateSort | 2025 |
| publisher | Universitat Politècnica de Catalunya |
| publisherStr | Universitat Politècnica de Catalunya |
| reponame_str | UPCommons. Portal del coneixement obert de la UPC |
| spelling | Analysis and development of polyglot files Analysis and Development of Polyglot Files Gonzalez Valdes, Paul Malware (Computer software) Cybersecurity Malware Polyglot Programari maliciós Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica Polyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesses of various formats that allow malicious code to be inserted by exploiting headers, end of files, and internal fields such as comment spaces. The cases studied confirm that polyglots have already been used in advanced campaigns, such as the Pegasus spyware, and highlight their role in the initial delivery of malware within more complex attack chains. Tests show that while signature-based antivirus software can detect some polyglots, others can evade antivirus engines and sandboxes, revealing significant gaps in current detection systems. In conclusion, polyglot files are a real and effective threat, especially when combined with advanced evasion techniques. Detecting them requires a more detailed analysis of file structures and new defensive strategies to counter increasingly stealthy and intelligent attack tactics. Universitat Politècnica de Catalunya https://hdl.handle.net/2117/451931 |
| spellingShingle | Analysis and development of polyglot files Gonzalez Valdes, Paul Malware (Computer software) Cybersecurity Malware Polyglot Programari maliciós Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica |
| title | Analysis and development of polyglot files |
| title_full | Analysis and development of polyglot files |
| title_fullStr | Analysis and development of polyglot files |
| title_full_unstemmed | Analysis and development of polyglot files |
| title_short | Analysis and development of polyglot files |
| title_sort | Analysis and development of polyglot files |
| topic | Malware (Computer software) Cybersecurity Malware Polyglot Programari maliciós Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica |
| topic_facet | Malware (Computer software) Cybersecurity Malware Polyglot Programari maliciós Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica |
| url | https://hdl.handle.net/2117/451931 |