## 1 Introduction
For example, most attack types are fooled by distillation mechanisms, with the exception of the C&W approach. The FGSM approach is one of the most widely used against malware detection systems. It has been extensively used to evade malware detectors for PE files. Ref. [11] proposed different append techniques, namely random append, gradient append, benign append, and FGSM append. In addition, they proposed an FGSM slack-based attack. Their attacks initialized the adversarial examples using random noises and then perturbed them using FGSM. They observed that these one-time examples were not transferable between models. Furthermore, FGSM attack required a large number of bytes to be modified. Ref. [12]  
\begin{table}
\begin{tabular}{|  
proposed an injection FGSM attack using a discrete input set to evade a neural network. Ref. [13] investigated the neural network's vulnerability against a gradient-based perturbation approach and proposed an append-based attack. Ref. [14] applied the attack presented in [13] by only perturbing the bytes inside the DOS header. However, Ref. [14] attack can be easily recognized by a human expert. Ref. [17] presented white-box and gray-box evasion attacks, perturbing 419 API features using JSMA with an \(L_{2}\) distance norm. Ref. [20] showed and analyzed the vulnerability of convolutional neural network (CNN), support vector machine (SVM), and random forest (RF) by C&W. To evaluate these detectors, the Microsoft BIG dataset was converted into binary texture grayscale images. The evasion rate of C&W was 100% against all presented ML-based malware detectors. In addition, the highest transferability rate for CNN reached up to 88.5%. This attack was limited by the lack of verified file executability. To overcome this limitation, the COPYCAT framework is presented in [21]. C&W is one of six crafting approaches used by the COPYCAT to generate executable adversarial malware samples. To ensure the executability of the adversarial examples, they applied the adversarial examples padding method, with the adversarial examples appended at the end of the original sample image. These researchers targeted Windows and Internet of Things (IoT) DL-based malware detectors. The evasion rate for C&W was 99.45%, with the minimum number of modified pixels being 4.09. After applying the padding, an overall misclassification rate of 73.5% was achieved. In 2023, fast-generation adversarial malware (FGAM) was proposed, introducing a method for quickly generating adversarial malware [23]. According to the gradient sign, this iteratively perturbs bytes, resulting in the enhanced adversarial capability of the perturbed bytes. In [24], a novel black-box AE attack towards the FCG-based malware detection system is presented, called BagAmmo. BagAmmo adopts the architecture of generative adversarial network (GAN). BagAmmo achieves an average attack success rate of over 99.9% on MaMaDroid, APIGraph, and GCN. The attack methodology involves the use of generative models to generate adversarial examples that successfully evade detection by BagAmmo. In this work, we contribute to the current literature via the following contributions:  
* **Investigate the vulnerabilities of DL-based malware classification using two approaches to crafting adversarial examples: C&W and JSMA. ** Previous JSMA works used API calls as input features to indicate how much each input feature's perturbations would affect the output. On the other hand, although previous works on C&W investigated the impact of the approach on continuous data, such as image representations of the malware binaries, we investigate its impact on discrete input, that is, raw bytes of the PE file. To our knowledge, this is the first work on C&W that uses discrete data input into the malware classification domain. * **Maintain malware while producing and crafting adversarial examples using C&W and JSMA. ** Previous studies mainly focused on malware adversarial images and differentiable domains, which differ from PE adversarial.