Technique:  Obfuscated Files or Information:Binary Padding
It used large size files to avoid detection by security solutions with hardcoded size limits.
It includes garbage code to mislead anti-malware software and researchers.
Bisonal has appended random binary data to the end of itself to generate a large binary.
Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.
It downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.
Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.
CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.
It has added extra spaces between JavaScript code characters to increase the overall file size.
A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.
FatDuke has been packed with junk code and strings.
It has used random junk code to obfuscate malware code.
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.
It has obfuscated .NET executables by inserting junk code.
Gelsemium can use junk code to hide functions and evade detection.
Goopy has had null characters padded in its malicious DLL payload.
Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.
GrimAgent has the ability to add bytes to change the file hash.
It performed padding with null bytes before calculating its hash.
Javali can use large obfuscated libraries to hinder detection and analysis.
Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
It has inserted garbage characters into code, presumably to avoid anti-virus detection.
Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.
It has been known to employ binary padding.
It has used junk code within their DLL files to hinder analysis.
It apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
POWERSTATS has used useless code blocks to counter analysis.
QakBot can use large file sizes to evade detection.
Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.
SamSam has used garbage code to pad some of its malware components.
Snip3 can obfuscate strings using junk Chinese characters.
TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.
WastedLocker contains junk code to increase its entropy and hide the actual code.
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.
yty contains junk code in its binary, likely to confuse malware analysts.
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.